General

  • Target

    a9d403efd3d1d5740a5b1d8a0d691422b4cede106265437f533523f2d7bac16e.exe

  • Size

    848KB

  • Sample

    240917-bspy5ayhqk

  • MD5

    ae75577913968ec41742093de9a8f00d

  • SHA1

    21cf02ec5fa8d8f4bc97803e02c3e638d51b69bd

  • SHA256

    a9d403efd3d1d5740a5b1d8a0d691422b4cede106265437f533523f2d7bac16e

  • SHA512

    7288f50eabdde4c2561d2c477dcc09416cb6ad40d05d8ec93c7695f0dfa558549228d892c8a7b36e30efb42435017c30c1e7511b6e1112e9ee523c51580d7673

  • SSDEEP

    24576:pnus9xWJ4JKWk4hSKP57dJNHwHXgKp2+zA:pnusSJEFtZdJNoXgizA

Malware Config

Extracted

Family

remcos

Botnet

3456789

C2

172.93.220.148:45682

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    765-8M14I5

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      a9d403efd3d1d5740a5b1d8a0d691422b4cede106265437f533523f2d7bac16e.exe

    • Size

      848KB

    • MD5

      ae75577913968ec41742093de9a8f00d

    • SHA1

      21cf02ec5fa8d8f4bc97803e02c3e638d51b69bd

    • SHA256

      a9d403efd3d1d5740a5b1d8a0d691422b4cede106265437f533523f2d7bac16e

    • SHA512

      7288f50eabdde4c2561d2c477dcc09416cb6ad40d05d8ec93c7695f0dfa558549228d892c8a7b36e30efb42435017c30c1e7511b6e1112e9ee523c51580d7673

    • SSDEEP

      24576:pnus9xWJ4JKWk4hSKP57dJNHwHXgKp2+zA:pnusSJEFtZdJNoXgizA

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.