Overview

overview

10

Static

static

3

7e329b19cf...3c.exe

windows7-x64

10

7e329b19cf...3c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b990ac5e7f65fee5ebd30c139af4ba57.bin

  • Size

    846KB

  • Sample

    240724-d7pysazane

  • MD5

    a500384375eb501677b2c6facbdb668d

  • SHA1

    b94b0a94636fe4561f564c9d380d397c954e201a

  • SHA256

    f7d21f12435478210026e52ad8e8e920ba0e338cf9a91d10310012e558a34e10

  • SHA512

    8f965227f7c19239c53bb03652338f1461ee65f71e7984156ca0441687e72ce999400af1e7cf882390bd6c1163dc9ca955bab614e49ea727ca54230ed5f1fd1e

  • SSDEEP

    24576:1YJvrp3qg+VfcI+kW+wjS8KsA1ZOS/ckYYD16p+:kDp3f+N+kzDgsl/DsM

Score
10/10
remcosremotehostdiscoveryrat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

192.3.64.149:2888

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-7Q1GRN

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      7e329b19cf17a8cba1c7102ed3758a5f50ffc7a95af0a1cf82e3244fa68efb3c.exe

    • Size

      863KB

    • MD5

      b990ac5e7f65fee5ebd30c139af4ba57

    • SHA1

      bee1ba9292111dbb3666baee872810c3993073f3

    • SHA256

      7e329b19cf17a8cba1c7102ed3758a5f50ffc7a95af0a1cf82e3244fa68efb3c

    • SHA512

      fb2c1dfa0ca4e94136cbff16e5029e1958cae0a92c270b53ea17ac77609d7e905bae2c81449d711c78c401f3710951e2bebe55c07dcd0e6ab61db65605212b9e

    • SSDEEP

      12288:+6DKcrMRVxFVaHw4bPOXbHrjJgYtbHtyKzpw1VEWZJ2MlyXDKj26V3TsRsreHdvQ:E9FVwwo0HjJBZeVZ22j26hrMdo

    Score
    10/10
    remcosremotehostdiscoveryrat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks