Overview

overview

10

Static

static

5

RFQ_pdf.exe

windows7-x64

10

RFQ_pdf.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9726f35d26663a77e4ed6528b2062c651778d6d7852afa60c8c5b6254a4ae67a

  • Size

    1.4MB

  • Sample

    240916-bn2r5ascrl

  • MD5

    af04f739f66a357841e5938165784dff

  • SHA1

    da5452ce3e8081ac445df75fa40f825d56e8e3d8

  • SHA256

    9726f35d26663a77e4ed6528b2062c651778d6d7852afa60c8c5b6254a4ae67a

  • SHA512

    4f06f6daf96b5197221f9adbda635735d2f8c6e79fc9712871d887c605d0f9e669f9c58945e7a771c855773e3186293c944cd9789270d352c3a6ad8966977e4f

  • SSDEEP

    24576:mS17+gMFp5qC+YbUi1ejqwUxvcUnfPw+XkOwHXZLYjP2457BJ1yoC3AnyaF4:mm+gqZUi1TwUxvcU3TXq824Jkv3Anyau

Score
10/10
remcosremotehostcollectioncredential_accessdiscoveryratstealer

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

154.216.18.214:2404

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-AOD6MB

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      RFQ_pdf.exe

    • Size

      1.9MB

    • MD5

      cca5ff9ed1bf853256cf60a14951b593

    • SHA1

      ab083cbbfca89e9422f8a6f196c248ebc13d738b

    • SHA256

      6a0274af2601d8713f03e1914c9d12cd2537ad6c542242b5b2c458e5915e532d

    • SHA512

      7027f633973c646c1c6db9e44e262e29547a179a30a1ddbcaef9a068591b3192ebf8ad9551785144cae77f3911709320f16c62336dcabc701076ba2598bdfca4

    • SSDEEP

      49152:OTvC/MTQYxsWR7aNYTOcVvAUBlXOOyYvSHzAB:GjTQYxsWRxvv5bK

    Score
    10/10
    remcosremotehostcollectioncredential_accessdiscoveryratstealer

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Detected Nirsoft tools

      Free utilities often used by attackers which can steal passwords, product keys, etc.

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Accesses Microsoft Outlook accounts

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks