General

  • Target

    52e5414e2e8aabecfc1c38926a3d863e1ee26bef5dc8453fc0568d9f263cf384.exe

  • Size

    1.2MB

  • Sample

    240831-bsh6ksxenh

  • MD5

    354b34a3694e2b4d54ba3bca624aa3c3

  • SHA1

    660ee183f7f7a17eace0556c8883a2c361424cb0

  • SHA256

    52e5414e2e8aabecfc1c38926a3d863e1ee26bef5dc8453fc0568d9f263cf384

  • SHA512

    f78bbbd45ee9dc147394f79c0aed2c8104c42116b72c653586ac0855d0c075e3b17571bc62e33ba055bcc91197f6e2a491e97ad35eab8f425bbf713a5e0b5870

  • SSDEEP

    24576:+tb20pkaCqT5TBWgNQ7aLHWD2rmiOWlcIqDBZLAkxy06A:rVg5tQ7aLHWDd/B9A65

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

spacesave.duckdns.org:14645

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-RLABK3

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      52e5414e2e8aabecfc1c38926a3d863e1ee26bef5dc8453fc0568d9f263cf384.exe

    • Size

      1.2MB

    • MD5

      354b34a3694e2b4d54ba3bca624aa3c3

    • SHA1

      660ee183f7f7a17eace0556c8883a2c361424cb0

    • SHA256

      52e5414e2e8aabecfc1c38926a3d863e1ee26bef5dc8453fc0568d9f263cf384

    • SHA512

      f78bbbd45ee9dc147394f79c0aed2c8104c42116b72c653586ac0855d0c075e3b17571bc62e33ba055bcc91197f6e2a491e97ad35eab8f425bbf713a5e0b5870

    • SSDEEP

      24576:+tb20pkaCqT5TBWgNQ7aLHWD2rmiOWlcIqDBZLAkxy06A:rVg5tQ7aLHWDd/B9A65

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.