General

  • Target

    e29e2c1019428f23f92327c4608c6aa8038b39889432be5bb0c7ce96ba63bacb.unknown

  • Size

    1.8MB

  • Sample

    240915-bxrzaaydpj

  • MD5

    ed8b3713eb5e99e89d8c25e0cf1a1c9c

  • SHA1

    65e561f5f32665f0e7f997bf6eda25ba4e614e5f

  • SHA256

    e29e2c1019428f23f92327c4608c6aa8038b39889432be5bb0c7ce96ba63bacb

  • SHA512

    05a34971e42de146713dbc7944f570ba09d94fd916fb92e8482a36a64e00be943d75d253c8ab35a2f348ae18726979e7696c6207478cb8a4459f41b0e784ec5c

  • SSDEEP

    24576:CBuCDJRpDyeGykCiwDbdStLd+1yvNF2q:CBDrxDGhDyF

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

127.0.0.1:52121

officerem.duckdns.org:52121

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-6GPUH1

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      RFQ 412.24 10.09.exe

    • Size

      1.8MB

    • MD5

      9aefd01233c746cdcfb120001a2defd2

    • SHA1

      599bb60793602a6fd2fae402dfc06d22d5a4a868

    • SHA256

      97d26e3c4d9c3fffe1a29eb0ef84681bb843cd06223d84bc947185107be4bba0

    • SHA512

      c4c072728ac7f12c127688f189f17201d3837e62d25cd6e6aca3f002c3182aa3374535cfc04b364fe944794a6058d09cb49ec7387ae3a731e37fbbb12800d425

    • SSDEEP

      24576:2BuCDJRpDyeGykCiwDbdStLd+1yvNF2qU:2BDrxDGhDyFr

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.