remcos | 4b42ed6bfed1bd64fbcc07e4ef108ae715802d54f2d7b1268aeab39d8a2966e8 | Triage

Sharing

General

Target

4b42ed6bfed1bd64fbcc07e4ef108ae715802d54f2d7b1268aeab39d8a2966e8.exe
Size

7.5MB
Sample

240922-blhlgavdmh
MD5

d5a3c4222b087ecabf47ffa4b4b05ec1
SHA1

32aa6710e55e113c578904884ce9dafc47d907d8
SHA256

4b42ed6bfed1bd64fbcc07e4ef108ae715802d54f2d7b1268aeab39d8a2966e8
SHA512

c278b8c64238d3d313c2d76506c545981a891404a20595679c35f4e10f7de3eaf028967ea1b9ab0c64c7bd48f2a8b90cd070e7c51a142de7d7d37bd216742d45
SSDEEP

98304:z5djeXAhCy1HDJQv8kVH0WUjqqTnYRoeEgmn1NX+6fnUXSvPLOqq21R2ajvLjgdR:z5djUAhCy1dUVx3vinLVdXMakf

Score

10^/10

remcos 20???septiem��2024 discovery persistence rat

Malware Config

Extracted

Family

remcos

Botnet

20???Septiem��2024

C2

ufye28738bd3yv23d783.con-ip.com:5023

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-WM7NR4
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Targets

- Target
  
  4b42ed6bfed1bd64fbcc07e4ef108ae715802d54f2d7b1268aeab39d8a2966e8.exe
- Size
  
  7.5MB
- MD5
  
  d5a3c4222b087ecabf47ffa4b4b05ec1
- SHA1
  
  32aa6710e55e113c578904884ce9dafc47d907d8
- SHA256
  
  4b42ed6bfed1bd64fbcc07e4ef108ae715802d54f2d7b1268aeab39d8a2966e8
- SHA512
  
  c278b8c64238d3d313c2d76506c545981a891404a20595679c35f4e10f7de3eaf028967ea1b9ab0c64c7bd48f2a8b90cd070e7c51a142de7d7d37bd216742d45
- SSDEEP
  
  98304:z5djeXAhCy1HDJQv8kVH0WUjqqTnYRoeEgmn1NX+6fnUXSvPLOqq21R2ajvLjgdR:z5djUAhCy1dUVx3vinLVdXMakf
Score

10^/10

remcos 20???septiem��2024 discovery persistence rat
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

remcos20???septiem��2024discoverypersistencerat

behavioral2

remcos20???septiem��2024discoverypersistencerat