Overview

overview

10

Static

static

3

Customer A...pt.exe

windows7-x64

1

Customer A...pt.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8fb37bc98599433b5b0a6709c8f3736ea83ae3a8b2e695a335f08bfc31d2225b.iso

  • Size

    1012KB

  • Sample

    240518-leax6add9s

  • MD5

    6fb4c56246729549db90121900566fd2

  • SHA1

    92d0796c3506712d5137277f279098d6920809dc

  • SHA256

    8fb37bc98599433b5b0a6709c8f3736ea83ae3a8b2e695a335f08bfc31d2225b

  • SHA512

    050e919a2f1654cca63ccb7b1e15b2435f78a39b0bcb850319e58155c57d3d4aaedcd2ba8d199d1fa24d43f415b6212d99686917886daf7ccf427692bd29577f

  • SSDEEP

    24576:nYTyQ+R2J+E34ppWnRM/ggnlWWf5tlD7k:npbkJqbMWBtN

Score
10/10
remcosfmglobalcollectionpersistenceratspywarestealer

Malware Config

Extracted

Family

remcos

Botnet

FmGlobal

C2

royaldachpharmacy.duckdns.org:6395

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    services.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    true

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-GRT17F

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      Customer Advisory - HS Code - Maersk Shipping/Customer Advisory - HS Code - Maersk Shipping.ppt.exe

    • Size

      947KB

    • MD5

      23f0cf81aa7d1c7a4a23e95e5a2595e4

    • SHA1

      0e477abeb86ae366d906a247e8f30b4ccdc02eef

    • SHA256

      a135b28345728e0533bf4bdad442dfee04d2e6f67e9b04ebb088919ef18d6601

    • SHA512

      208db7a72859d78a9b9ee235f78ae55b3fbc05fec9c475c5aaf66ffd50e4d9c16d58620473a21ffd0c19874b4906f9c0b7b1e77b6bd22f9cf87789ad3d4ab0e9

    • SSDEEP

      24576:/YTyQ+R2J+E34ppWnRM/ggnlWWf5tlD7k:/pbkJqbMWBtN

    Score
    10/10
    remcosfmglobalcollectionpersistenceratspywarestealer

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook accounts

      collection

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks