General

  • Target

    16558611966.zip

  • Size

    113.8MB

  • Sample

    240411-bb8d5sfh98

  • MD5

    208d278e800d6098b7a6ad8a1e24ea84

  • SHA1

    0e0a5e4dbb1844ad82605635bbdcba448372f797

  • SHA256

    41933907aa1a0a52368952fb3f5e9348e044fe8f305fcf685b66ce3df7ebecf4

  • SHA512

    c2104ca040921e49e5a4e3ed2584ed9cf0ab837eaf2c2aa7dd65125fe8846f5b277a6a0e4416f591e2925e87f6045337b790a4c3e071f04ea09bda7fd6cf487e

  • SSDEEP

    1572864:agil7aO8NDnY+eAyW7PQfIUME2vCICvGVwDJr4gNzCccH6GuPh1IAyb1D5kR3Mfi:C8NDMAN7PQfIA2vC44Jr4Pa7p+bPnEJ

Malware Config

Extracted

Family

remcos

Botnet

tutt0a

C2

peleinufele.kozow.com:32024

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-TUPCDH

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      1099Misc.inf

    • Size

      130.0MB

    • MD5

      f158d3387c6e2cb1b482f7b7abee7e20

    • SHA1

      9aadedb8049339dd027a45bc733caa1f6f3dc7a9

    • SHA256

      c052369f476b624913e8aec1a3ba729d30b5d5f145c4c5c58d64f7d09cfa54b5

    • SHA512

      93e92533c93d966007eaf6fb35772e362326eb8bd321f1db28cfa98943277589a393081157a8832f162776127eb91974e3f93a2ea3475e936db1f228973bc40e

    • SSDEEP

      3145728:96lH+byk0ZggBznCh2HCea5bQ92NmDVr9XqnZGWp:

    Score
    1/10
    • Target

      TAX Organizer.exe

    • Size

      31KB

    • MD5

      3e71ed46603b02a94b921411a19b7a5c

    • SHA1

      b1374ef6717635d07015d8acb700cf95b2a66b12

    • SHA256

      1131f33552a12921f6f4d7d9e503feae4b12c367d5377e226acf270f6b58ca6e

    • SHA512

      28555a8bf20e4f8d42b21685c06e429bc5261f75e9fb65b970a322907d7da4a4ee7d367f4637ea4abb6ef32fae8e71a9d92b4f253a201e94548d68281edccbaf

    • SSDEEP

      384:e8Kj/M8yEryzqEt7a9Oey+IFdP64VYaEwDtiBgxoxlnLr2STcEICxXBhgBx4eMDa:eDD1r+VWOV+csoHViBBn+EFIqeMDGvaS

    Score
    10/10
    • Remcos

      Remcos is a closed-source remote control and surveillance software.

    • Suspicious use of SetThreadContext

    • Target

      g2m.dll

    • Size

      140.0MB

    • MD5

      51b4ce3a76e12140cfa7f0fa6e910bc5

    • SHA1

      7d7ff60af7f57c22d482453354916744c66f5f97

    • SHA256

      c0bf5beff71a0b2536994fb2987410b11c7a3a90a5a1ace76cdec2df104563d0

    • SHA512

      3281f0f5cac3f19c3d0e3ad1f4e31c08e799a1e496b40c79c1d09b88e07dd223510a8c87440b521e605dc4ea8212cd2529c000b76f3a14ffae1b3467ff9f6180

    • SSDEEP

      786432:EUP7GCGO7b0Srkx/tC0SzIdSwh/WxbpNHQD3trzRpY:EUP7GCG64Srkx1hSzYsHQD3t/R

    Score
    10/10
    • Remcos

      Remcos is a closed-source remote control and surveillance software.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks