Overview

overview

10

Static

static

3

Customer A...oc.exe

windows7-x64

3

Customer A...oc.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    079d051b9169f0fad48d1a00b45acbac6da72589bec347eb86b3ba5471a504c0.lzh

  • Size

    499KB

  • Sample

    240525-w38t7sea29

  • MD5

    5848fdd44ea4df6c602a2d9b62267148

  • SHA1

    968802d20229e376d3abcefa5c3707f7e4777ec8

  • SHA256

    079d051b9169f0fad48d1a00b45acbac6da72589bec347eb86b3ba5471a504c0

  • SHA512

    92feb964d0b5e42011074d435db2893c69bd3d581d32761afb8a4ea46062c0f6f43e45ff8d6c961774c14901bb820d0658392ace7e146479a9f5f286d30541e4

  • SSDEEP

    12288:iEjFfHHEc28/2qbusqYSj47LL3EIxVx11:TFfHH9F1busqjE3RVx11

Score
10/10
remcosfmglobalcollectionpersistenceratspywarestealer

Malware Config

Extracted

Family

remcos

Botnet

FmGlobal

C2

royaldachpharmacy.duckdns.org:6395

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    services.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    true

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-GRT17F

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      Customer Advisory - HS Code - Maersk Shipping/Customer Advisory - HS Code - Maersk Shipping.doc.exe

    • Size

      1.3MB

    • MD5

      a55159c7edc073d452e4fef92d247997

    • SHA1

      d239b25b2a33a64134f11d2d2ac5c7a89e186a29

    • SHA256

      61fc662a678c75e1f17ee6bb00ef853c6d51bd4ae90616c8ed4995c45e96206d

    • SHA512

      5189f51ce0f90a71e86e53ea23d564d796536c45db8c8f4a11e75947bb4fc0d2489c83899e4a8e8b81504007ccad7a05dc8ac02b0d47a52ea565396a27c5e8b3

    • SSDEEP

      24576:AP+g7Wy3xfMZKdcKtTjbJ4jEEEEEEEEEEEEEEEEEEEETKKKKKKKKKKKKKKKKKKK7:A/iy3g6TjbIEEEEEEEEEEEEEEEEEEEE+

    Score
    10/10
    remcosfmglobalcollectionpersistenceratspywarestealer

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook accounts

      collection

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks