Overview

overview

10

Static

static

3

GST e-Paym...71.exe

windows7-x64

10

GST e-Paym...71.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    936f6480b7bbdfc5b75cb7922590c16663c790bedb8c34495468226cb0ded619.rar

  • Size

    520KB

  • Sample

    240517-b5x59sbg92

  • MD5

    0f305d905b75f0c7568fb843527b65cd

  • SHA1

    d4f12cf724ce019b8d261a8b4c5f60986becc82e

  • SHA256

    936f6480b7bbdfc5b75cb7922590c16663c790bedb8c34495468226cb0ded619

  • SHA512

    87a4d7c4ceb70b252ee319fe415d0fb403d32cefa0902c9cbe3c54113d9708c0bf17a6934df0acfdb7ab527c365dd1b84a5c8f2ce2f7417a9cafc727d069d204

  • SSDEEP

    12288:mRthtumX0AhMg8Tx/Ggu2CINBLF03vFpAlPVXP:OjumXpnN2CiLaFpAT

Score
10/10
remcosbanksyexecutionrat

Malware Config

Extracted

Family

remcos

Version

1.7 Pro

Botnet

banksy

C2

62.102.148.166:3319

Attributes
  • audio_folder

    audio

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    5

  • copy_file

    remcos.exe

  • copy_folder

    remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • install_path

    %AppData%

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    egsy

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    remcos_rpklfmytvo

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screens

  • screenshot_path

    %AppData%

  • screenshot_time

    1

  • startup_value

    remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      GST e-Payment.NET.CMS4006900371.exe

    • Size

      610KB

    • MD5

      a83c7c19a689b683942bf29ebcc82e07

    • SHA1

      535cdf86f5c064932fea71d169ba1c9e3acf4886

    • SHA256

      33cc55fef11d691d7728275b1e7dfc61520cef61bb0035de7dfb8e648f086f50

    • SHA512

      58cf11e78fcd01715e1ce9b0877b601d56f95681bc82986e0d7fc6d58a8a9169e28fa46a134bed1000672bd52fe7b2c291fff4bb3fe540d18ec240204bad1881

    • SSDEEP

      12288:y0pei36RatdHmBK2h+RrUm1jkHui7jkNAMo6WDNGn7cX0O2eEAmD:Vpp36stJqDwRrp6Z7P6uGn4kO2e

    Score
    10/10
    remcosbanksyexecutionrat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • detects Windows exceutables potentially bypassing UAC using eventvwr.exe

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks