Overview

overview

10

Static

static

5

Rgh99876k7e.exe

windows7-x64

7

Rgh99876k7e.exe

windows10-2004-x64

10

Resubmissions

03-09-2024 15:03

240903-sfh4gszekl 10

03-09-2024 14:45

240903-r4rj4azcmm 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Rgh99876k7e_1.z.zip

  • Size

    915KB

  • Sample

    240903-r4rj4azcmm

  • MD5

    5798367ab426fa78e64c6592a60a56be

  • SHA1

    03bab11b13abe17280308648d377da940a86485f

  • SHA256

    68ab656fe4de37c4f94a9b5cd800390ad80caf8782f135422aa7c9392ad9f57c

  • SHA512

    8bbd4c521bfb14d24453b44d00bf5f6b545c8ed3bfb09ff0be759240f80d7c89669eb6b95d1d9cd8f986854471ac1daa2df726e7c2d40d869acbfd0d861287f3

  • SSDEEP

    12288:Rxsb7EOAB32hpNqyndv4rmieC1B0uzZlVnSFk7hfE8EvH82ZJioJa1OZ:TqLZdArm5Cv00Z3S+hfE8Evc2rJaa

Score
10/10
remcosremotehostcollectioncredential_accessdiscoveryratspywarestealer

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

192.210.150.26:8787

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-NKQ1SM

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      Rgh99876k7e.exe

    • Size

      1.5MB

    • MD5

      bd6420aaf066a5b4533598417866bc67

    • SHA1

      cf56376da61f4f34034fa4cc525e708052a5ecd3

    • SHA256

      b8022e8002a8e01a6364fdcc6d53275b6edf3d196e36f0b4c9645de2570cfd48

    • SHA512

      d9b394fc25949d552b64061810cd4452d24ee473c5755bada25b1db5ad35652a57b545c53c5e1dea88feac376b86e838a6b87886e9ad50e1f582eb2b985cda78

    • SSDEEP

      24576:zqDEvCTbMWu7rQYlBQcBiT6rprG8auS2rwF3q65FE8wvsO5BaH3:zTvC/MTQYxsWR7auSY65G8wDKH

    Score
    10/10
    discoveryremcosremotehostcollectioncredential_accessratspywarestealer

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Detected Nirsoft tools

      Free utilities often used by attackers which can steal passwords, product keys, etc.

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook accounts

      collection

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks