General

  • Target

    4a7309f0f34888f6e54fea0ee3947eb0_NeikiAnalytics

  • Size

    640KB

  • Sample

    240510-crq1gadb81

  • MD5

    4a7309f0f34888f6e54fea0ee3947eb0

  • SHA1

    805260112925e33980ee4c8071be0e204b9ff166

  • SHA256

    4613678766ac92ef960e451702e8391a0f09b8fb3195f75a53199c6a8e8d0161

  • SHA512

    721741dce33b548875987f53a9a432a2b621a30f304b52ca837b793a7a264b9017801bd076dea96b4737c1a75ed676d497be725db0d3a3c71004503e9787047c

  • SSDEEP

    12288:+Du7vHDZc3ivcTlUEv5x0Ho0+Jf/t/rjhPfLXDIR/47+LxKwShsYN:z7PDZc3iZS0I0+Nxhbk/4eShJN

Score
10/10

Malware Config

Extracted

Family

remcos

Version

2.4.5 Pro

Botnet

admin

C2

rem-pounds.ddns.net:9970

Attributes
  • audio_folder

    MicRecords

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    true

  • install_flag

    false

  • install_path

    %AppData%

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    Remcos-YWGXE2

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

  • take_screenshot_title

    wikipedia;solitaire;

Targets

    • Target

      4a7309f0f34888f6e54fea0ee3947eb0_NeikiAnalytics

    • Size

      640KB

    • MD5

      4a7309f0f34888f6e54fea0ee3947eb0

    • SHA1

      805260112925e33980ee4c8071be0e204b9ff166

    • SHA256

      4613678766ac92ef960e451702e8391a0f09b8fb3195f75a53199c6a8e8d0161

    • SHA512

      721741dce33b548875987f53a9a432a2b621a30f304b52ca837b793a7a264b9017801bd076dea96b4737c1a75ed676d497be725db0d3a3c71004503e9787047c

    • SSDEEP

      12288:+Du7vHDZc3ivcTlUEv5x0Ho0+Jf/t/rjhPfLXDIR/47+LxKwShsYN:z7PDZc3iZS0I0+Nxhbk/4eShJN

    Score
    10/10
    • Remcos

      Remcos is a closed-source remote control and surveillance software.

    • Drops startup file

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks