Overview

overview

10

Static

static

1

94338a235c...42.exe

windows7-x64

10

94338a235c...42.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f4aedd9c8b06bf6f30404ae4c5de18c0.bin

  • Size

    874KB

  • Sample

    240826-cb1jzazfkn

  • MD5

    1e9ffd0a37fee065cbf927c6b152f27f

  • SHA1

    03cf20a71a64c065e14ada8fe82d5a859fa2c41f

  • SHA256

    a822973ac832a45aa3784af37366fdded644234fb77f3980eb0ec75d092d33ec

  • SHA512

    fa571f110f2943a0453663a9cf8778bf1e11b669ff03f1d90783ebd6203ff667a7d8b37ea0779e0a0fb315814d05aa9159924315417c71813ba4aae98ac7c048

  • SSDEEP

    24576:53YHex2RWiYEjDZokn5uSfSnGAN0KxqwIe:5oHekDjl5zfqGApxXR

Score
10/10
remcosaug 20c2discoveryexecutionrat

Malware Config

Extracted

Family

remcos

Botnet

Aug 20C2

C2

method8888.ddns.net:6902

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-81VELC

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      94338a235c9207ba31032496ba04d39ae887a3155c15d57347307df2dfa16242.exe

    • Size

      936KB

    • MD5

      f4aedd9c8b06bf6f30404ae4c5de18c0

    • SHA1

      9f3b3c5c600416806ca99050f0fe8428e0215720

    • SHA256

      94338a235c9207ba31032496ba04d39ae887a3155c15d57347307df2dfa16242

    • SHA512

      bb95bb409162e2eb1b4b17f52409c91ed38ac4fb695944fb88607df96279778626af650db6028d96e8bce742480ad9f3971896e08e6417712ee06a256111e39a

    • SSDEEP

      24576:Y9MC/qaSu32aV7pOsOwCWiB3F8mUlUAPrs3L0hMa2aa1ucko/8gv:riUu32I+jFvU6APA70hMaz+koX

    Score
    10/10
    remcosaug 20c2discoveryexecutionrat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks