General

  • Target

    3c77c4dfca5e491bdc7c81ce126eac8f335a272439f50d48c743e085b0fb0cdd

  • Size

    968KB

  • Sample

    240410-zjph1aba99

  • MD5

    01ab33911b5f2304c41fb68dd98efddf

  • SHA1

    11233230a98f9fa576395c78f94e68cca908db74

  • SHA256

    3c77c4dfca5e491bdc7c81ce126eac8f335a272439f50d48c743e085b0fb0cdd

  • SHA512

    e0bf353ce93cd902e148ee047e12ac104623ebda6e81ad889fbf8734979fc3a0cbc2c0a40ae155d257f9172e9371d3470910eda24919317548c380db9fcbf69f

  • SSDEEP

    24576:CAHnh+eWsN3skA4RV1Hom2KXMmHaAasbwhgl5p:Fh+ZkldoPK8YaAzp

Score
10/10

Malware Config

Extracted

Family

remcos

Version

2.4.3 Pro

Botnet

HostMEM

C2

79.134.225.27:4001

Attributes
  • audio_folder

    MicRecords

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    3

  • copy_file

    remcos.exe

  • copy_folder

    remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • install_path

    %AppData%

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    Remcos-EZS8B1

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

  • take_screenshot_title

    wikipedia;solitaire;

Targets

    • Target

      3c77c4dfca5e491bdc7c81ce126eac8f335a272439f50d48c743e085b0fb0cdd

    • Size

      968KB

    • MD5

      01ab33911b5f2304c41fb68dd98efddf

    • SHA1

      11233230a98f9fa576395c78f94e68cca908db74

    • SHA256

      3c77c4dfca5e491bdc7c81ce126eac8f335a272439f50d48c743e085b0fb0cdd

    • SHA512

      e0bf353ce93cd902e148ee047e12ac104623ebda6e81ad889fbf8734979fc3a0cbc2c0a40ae155d257f9172e9371d3470910eda24919317548c380db9fcbf69f

    • SSDEEP

      24576:CAHnh+eWsN3skA4RV1Hom2KXMmHaAasbwhgl5p:Fh+ZkldoPK8YaAzp

    Score
    10/10
    • Remcos

      Remcos is a closed-source remote control and surveillance software.

    • UPX dump on OEP (original entry point)

    • detects Windows exceutables potentially bypassing UAC using eventvwr.exe

    • Drops startup file

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks