Overview

overview

10

Static

static

1

A1_racun_0...df.vbs

windows7-x64

10

A1_racun_0...df.vbs

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e4ea11f5460a15c91a45fab777cdef0c3245e732a41f2f485e2d7bfdd989f9be

  • Size

    32KB

  • Sample

    241001-mdbczaycma

  • MD5

    b8d874d4c765cb0fb96e0680383ff62a

  • SHA1

    81066104cc95ed2e5c99c0ee021eead7ccece6f9

  • SHA256

    e4ea11f5460a15c91a45fab777cdef0c3245e732a41f2f485e2d7bfdd989f9be

  • SHA512

    5a9c300fe2a6aac9dc79cc27f2391a8494f705d85f7644b7a3d8cc5d755c80188e8197a6001dd627c7d83bc99fe35db8d35f84ba82fa08d9b18400235a5427d2

  • SSDEEP

    768:HmKg079D+R19Yn6oy6Hgi5WxhN3gqxfWr4sm50IU4Qz:H7gG6nWntAVxT3BArPIU4Qz

Score
10/10
remcosremotehostdiscoveryexecutionrat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

a458386d9.duckdns.org:3256

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • delete_file

    false

  • hide_file

    true

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    true

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-WDQFG0

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      A1_racun_09-2024·pdf.vbs

    • Size

      72KB

    • MD5

      75c46eded8d56cffa52b4bf86615c200

    • SHA1

      8519d8a27d4663d6c3c70991c0cc757d16790b4e

    • SHA256

      8e1d67ca2d0e0003ed384472bc64f1c659ea0433539b821203c7e4d42b5efe18

    • SHA512

      3732e3bb921c00dd67d9f630b6638ec05aa097a4e7b4ffdb7344014ee9ba74d8924db42f1d6789577529573bbfca03394cde3e81d4253dd013dcbb2833a07d8d

    • SSDEEP

      1536:sBg98qp1hVcA8ACb+p3HzYxZ+cBvSnAnO70P5XIf:si9fvAAO+lcBanCOZf

    Score
    10/10
    remcosremotehostdiscoveryexecutionrat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks