Overview

overview

10

Static

static

3

tmp.exe

windows7-x64

10

tmp.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    tmp.bak

  • Size

    1.1MB

  • Sample

    240424-cmsy9seb5x

  • MD5

    12886a2dee7a2b1317ecf8ffd45fdaf0

  • SHA1

    e17838a0fb05d7937da2b9cb93eccb3073ed6433

  • SHA256

    e06192109b6d3127d32b4c12cf7b2be4c3f92786cdafed85dabaa4ee612f2035

  • SHA512

    cf1e1855b62eb2e44e4308b2c0c77d2f3a1480474f308bc650e3b262822d0918594fc7fcabaf79fb05e2610068c70b75f6bbaca09ab59fde8f9f4aa29e1b23b0

  • SSDEEP

    12288:Wo4uvLCzxsmw76ZNhGzwtsML5oEYWd/KFMgARCgPvu47KsPGO31Moviein4ox3CT:WYLCmgrOwvN/KFMgAQgPSWliei4oxyT

Score
10/10
remcosaslavescollectionrat

Malware Config

Extracted

Family

remcos

Botnet

ASLAVES

C2

64.188.18.137:1604

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-WVCSRD

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      tmp.bak

    • Size

      1.1MB

    • MD5

      12886a2dee7a2b1317ecf8ffd45fdaf0

    • SHA1

      e17838a0fb05d7937da2b9cb93eccb3073ed6433

    • SHA256

      e06192109b6d3127d32b4c12cf7b2be4c3f92786cdafed85dabaa4ee612f2035

    • SHA512

      cf1e1855b62eb2e44e4308b2c0c77d2f3a1480474f308bc650e3b262822d0918594fc7fcabaf79fb05e2610068c70b75f6bbaca09ab59fde8f9f4aa29e1b23b0

    • SSDEEP

      12288:Wo4uvLCzxsmw76ZNhGzwtsML5oEYWd/KFMgARCgPvu47KsPGO31Moviein4ox3CT:WYLCmgrOwvN/KFMgAQgPSWliei4oxyT

    Score
    10/10
    remcosaslavescollectionrat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Uses the VBS compiler for execution

    • Accesses Microsoft Outlook accounts

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scripting

1
T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks