General

  • Target

    6c51137c03e51358fb4b0dfeafeda780_NEIKI

  • Size

    967KB

  • Sample

    240508-1vadwsca75

  • MD5

    6c51137c03e51358fb4b0dfeafeda780

  • SHA1

    f36b715fc0a25bef300cf14fdf57e28b0feed405

  • SHA256

    dfc6cbef1b47c7576f74c9675441d3debd0e0df1fa773108725dd28bdafd6a36

  • SHA512

    82a65e78de70108991a515c8c263bea1f83f8de221292a3345c16c54e7920be44a61084d2cec8a6fa3c414d577c1c134613a6889247f491be0622029eecd4f4b

  • SSDEEP

    24576:CAHnh+eWsN3skA4RV1Hom2KXMmHaAasbwhgl5f:Fh+ZkldoPK8YaAzf

Score
10/10

Malware Config

Extracted

Family

remcos

Version

2.4.3 Pro

Botnet

HostMEM

C2

79.134.225.27:4001

Attributes
  • audio_folder

    MicRecords

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    3

  • copy_file

    remcos.exe

  • copy_folder

    remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • install_path

    %AppData%

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    Remcos-EZS8B1

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

  • take_screenshot_title

    wikipedia;solitaire;

Targets

    • Target

      6c51137c03e51358fb4b0dfeafeda780_NEIKI

    • Size

      967KB

    • MD5

      6c51137c03e51358fb4b0dfeafeda780

    • SHA1

      f36b715fc0a25bef300cf14fdf57e28b0feed405

    • SHA256

      dfc6cbef1b47c7576f74c9675441d3debd0e0df1fa773108725dd28bdafd6a36

    • SHA512

      82a65e78de70108991a515c8c263bea1f83f8de221292a3345c16c54e7920be44a61084d2cec8a6fa3c414d577c1c134613a6889247f491be0622029eecd4f4b

    • SSDEEP

      24576:CAHnh+eWsN3skA4RV1Hom2KXMmHaAasbwhgl5f:Fh+ZkldoPK8YaAzf

    Score
    10/10
    • Remcos

      Remcos is a closed-source remote control and surveillance software.

    • Drops startup file

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks