Overview

overview

10

Static

static

3

BLdraftedC...24.exe

windows7-x64

10

BLdraftedC...24.exe

windows10-2004-x64

10

$PLUGINSDI...er.dll

windows7-x64

1

$PLUGINSDI...er.dll

windows10-2004-x64

1

$PLUGINSDI...ge.dll

windows7-x64

1

$PLUGINSDI...ge.dll

windows10-2004-x64

1

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

Elektroing...rs.app

macos-10.15-amd64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    BLdraftedCopy200524_1.gz

  • Size

    375KB

  • Sample

    240520-kbvygsbe92

  • MD5

    47f41744f12869944f746c5f17fe1110

  • SHA1

    4f50b83c0b2ab714a8172bac1c8881bf95c28907

  • SHA256

    274086842325654e8c2e2f756629b4fc3532d2b54cbcea3ab207b23782fa56a7

  • SHA512

    0a0aaf6469107918d321239a1f46e0f0089433136403cd763496b8737f665627f8022e4da8eb189a5591ad641eba81a13757e46dcbfe11edf547a6abc892d054

  • SSDEEP

    6144:MQLFFDhKT94GrGFhOohlLza0r1jdBmhptW5yXGosluIzhkRGfGU/608hv3vQv:33m94GC/OMza0pRBbsXG98Iz+mG7hv3C

Score
10/10
remcosremotehostcollectionmacosratspywarestealer

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

64.188.27.90:2404

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-COHIYL

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      BLdraftedCopy200524.exe

    • Size

      472KB

    • MD5

      04b8fc8f6182aa25305b19c0917aa7d7

    • SHA1

      fcf7d768cb6ba5067723b694984fd20b8e0a079a

    • SHA256

      f08569862f95f332a676932f77eed6f4321c1e6bf3f24a6f3398dc6608ca8353

    • SHA512

      0118012b0eb44b91037b8a31fb5fd3fc55042d9009756badf221d9c24943e294521688cc90c47285ecd11d165a8c6b6bf4bcf6675d0412e2c385346e8cc53811

    • SSDEEP

      12288:vi3hR5SANo8/O2zaKBtD1sJG9GIzwmG5hvnHQ:K3hv5j/zbDmskwwm+dQ

    Score
    10/10
    remcosremotehostcollectionratspywarestealer

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook accounts

      collection

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/Banner.dll

    • Size

      4KB

    • MD5

      0d5428f7920274caedfa8f2ae980e196

    • SHA1

      ce2ca2381a4b9ed9f06f6af5a183a840de290c3f

    • SHA256

      4083bef584ad6793b3d57e3e3f764a31afac876412df65c5da5afee76bbd1e10

    • SHA512

      78419752f3e6579f7caf1f9bab70a46ac2b0a7c5f08eb8604e927baea611c182133ce8d58929a059f22e6c2befb5ff0c24ee6500d0708bc884a65e395ea7c4cf

    Score
    1/10
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/BgImage.dll

    • Size

      7KB

    • MD5

      9436196007f65f0ae96f64b1c8b2572e

    • SHA1

      4b004b5c2865c9450876be83faa8cc96e1d12c01

    • SHA256

      286f246ee18bf91c4a80fa2cdb61077a4bcf0a3fd6582be4b4ab6a5cb3de44c9

    • SHA512

      5c172675fbbea214471ac35eebaa6ab9bd1306268144085adbad3bba4a815430ed028cac169e8b5a6fd00818684f65d7bdd32f11773bc6152e62ef80f895d35e

    • SSDEEP

      96:8egk1LFJaO1/radJEaYtv1Zs4lkL8y3A2EN8Cmy3uT24j7J3kWyy/:t7TJa2roqJyA2EN8diuTHje

    Score
    1/10
    behavioral5behavioral6

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      8b3830b9dbf87f84ddd3b26645fed3a0

    • SHA1

      223bef1f19e644a610a0877d01eadc9e28299509

    • SHA256

      f004c568d305cd95edbd704166fcd2849d395b595dff814bcc2012693527ac37

    • SHA512

      d13cfd98db5ca8dc9c15723eee0e7454975078a776bce26247228be4603a0217e166058ebadc68090afe988862b7514cb8cb84de13b3de35737412a6f0a8ac03

    • SSDEEP

      192:ex24sihno00Wfl97nH6BenXwWobpWBTtvShJ5omi7dJWjOlESlS:h8QIl972eXqlWBFSt273YOlEz

    Score
    3/10
    behavioral7behavioral8

    • Target

      $PLUGINSDIR/nsDialogs.dll

    • Size

      9KB

    • MD5

      82c3f38cd34739872af07443c65d0bd8

    • SHA1

      1f4ee2d394404a291eda6419f856adaf4b960237

    • SHA256

      59cdb2c12d5635fd25af4007b70222507948be41fa9885b7f07967c2510a5311

    • SHA512

      3a81c0613b1ea906ad4f103b02620217de69a8676dbb7ec41cf31f342a0a74562815a8d4f2efe9866fc16365f58524ac71652e99920acea355f020028775743d

    • SSDEEP

      192:ow8cSzvTyl4tgi8pPjQM0PuAg0YNy+IFtSP:lBSzm+t18pZ0WAg0R+IFg

    Score
    3/10
    behavioral10behavioral9

    • Target

      Elektroingenirers/Sabbatters.app

    • Size

      1KB

    • MD5

      6d05f4d490578ac56f35a2fb0fdc48c3

    • SHA1

      98cbe66769dca00383a1e6345a0af8d8f5158802

    • SHA256

      68c60b54d23a7eac7decbd381934147857868b1b5f14a5087cc7d691f68670d6

    • SHA512

      0d038240e209b7b478d66800c76668fe40b10ffca149b1920946fb025ba5f1be9f20cd75e689cae6c9e5d9c2f722bf54b5bc2783602a0379def34be48e6753b5

    Score
    1/10
    behavioral11

MITRE ATT&CK Enterprise v15

Tasks