General

  • Target

    MalwareBazaar.10

  • Size

    842KB

  • Sample

    240723-j5mzaswdmd

  • MD5

    9c48437f190dfb0958e0293000882802

  • SHA1

    a37e32b69fedb87ca90b172fe0839b85c7b92444

  • SHA256

    46a534c55f60d8e902a84484a2c0d4bb750d0eb926ebab10117160c1f1aa0081

  • SHA512

    897bdaaff48b0ec4cc5e3d3114418bf5ce9f3d5d9f5da343a564e2132dc62b0b145bd56526b601a8b8d954b7041af0ef27be068ecc83eb8b12aed048eaec1dcf

  • SSDEEP

    24576:tk8NAYRng7SeKCRIfNun0dRn4ynCOv26cf0XzLZ:qoAYyKCRQu0/nFdBcfiz1

Score
10/10

Malware Config

Extracted

Family

remcos

Botnet

ZIP

C2

vegetachcnc.com:2556

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    chrome-76G0MC

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      Quotation.exe

    • Size

      2.7MB

    • MD5

      df3a32a59e276774a045fd80fa2b53db

    • SHA1

      ce4bb00e51f685b3ec7eb8100047c82db1f8be72

    • SHA256

      043f6e5b65055436ee950f3ebd72ed16589a34742deea3ad82e946bba1b94728

    • SHA512

      7811cace2b99777f1980c7021fca67f9500d5a140aa73ff02fa19327db134710cc97e6d8b7ad1b58592dd23ed2a548fe5cf520227654c05ff2f0c23336b8fb0d

    • SSDEEP

      24576:JoawHU1iLq121i1IqzUlfC1QZ6KEJeEZ+ZZY:JoaMU1iLqM1ij4SQ5ECZY

    Score
    10/10
    • Remcos

      Remcos is a closed-source remote control and surveillance software.

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks