Overview

overview

10

Static

static

3

Remcosv4.9...OD.exe

windows7-x64

10

Remcosv4.9...OD.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    Remcosv4.9.3LightMOD.exe

  • Size

    40.3MB

  • Sample

    240615-xpgdgavhpj

  • MD5

    d3de21913cdebc1c84d668de22831d85

  • SHA1

    2619ebb87016473c06ed820a8d26120b704b8023

  • SHA256

    4ff6da365ddd8c3f3e4c186022ab9447b2f6123adf991a81cd58bc71ecb2522a

  • SHA512

    bccee54ff31b9321020276c311f609951c47dac790ddfc47bcca0d19052fcd5d27340cb99d87f4c762e11c99f39a2b7cbe379d2fabdc8da91c637adccd8339cf

  • SSDEEP

    786432:MukwgGc0LdSPyiMJj2uK0P7ts6CcEwVOgjxBdgoz8pF4zqIdvXO/:Xc0QaiYj2AP7y62wV5jxBXVPG

Score
10/10
quasarremcosspywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Remcos

C2

team-circles.gl.at.ply.gg:25349

Mutex

109bae44-c7e4-46f2-82cd-2c3efb4dc47e

Attributes
  • encryption_key

    78AF43F549EE55D0FC30D38EC96EAA6F3A3F5CDF

  • install_name

    Runtime Broker.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Runtime Broker

  • subdirectory

    WD Defender

Targets

    • Target

      Remcosv4.9.3LightMOD.exe

    • Size

      40.3MB

    • MD5

      d3de21913cdebc1c84d668de22831d85

    • SHA1

      2619ebb87016473c06ed820a8d26120b704b8023

    • SHA256

      4ff6da365ddd8c3f3e4c186022ab9447b2f6123adf991a81cd58bc71ecb2522a

    • SHA512

      bccee54ff31b9321020276c311f609951c47dac790ddfc47bcca0d19052fcd5d27340cb99d87f4c762e11c99f39a2b7cbe379d2fabdc8da91c637adccd8339cf

    • SSDEEP

      786432:MukwgGc0LdSPyiMJj2uK0P7ts6CcEwVOgjxBdgoz8pF4zqIdvXO/:Xc0QaiYj2AP7y62wV5jxBXVPG

    Score
    10/10
    quasarremcosspywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks