Overview

overview

10

Static

static

3

?????? - ?...01.exe

windows7-x64

10

?????? - ?...01.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cd4d76cf155a0fd49a192b9ffe6ba360361bd469516215ffd1a54c4b0649fcdd.tar

  • Size

    659KB

  • Sample

    241002-b6fydavdjb

  • MD5

    f74454a5da0b5b8fb619eee6bd8b714f

  • SHA1

    be4a9091716dc68f13a7751f84d92be4b5fcde3e

  • SHA256

    cd4d76cf155a0fd49a192b9ffe6ba360361bd469516215ffd1a54c4b0649fcdd

  • SHA512

    63dd22cd06c65dfaeca2251cca9f72a80b8d5bfd7ed9c77eb7919c23c144859a90c9d5e10426cad0e33db1ba66187aa43eb60269d4f032d9cc8c1424cca7d16f

  • SSDEEP

    12288:FXJ5r639UgrDDIVWN+YP7924lgRgPetEsVtDZoeDl51SKd0714/:f5r6//DIVWUYj925RgPetEsVcy51pd0J

Score
10/10
guloaderremcosremotehostcollectiondiscoverydownloaderratspywarestealer

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

172.245.93.118:25000

172.245.93.118:26000

172.245.93.118:2484

172.245.93.118:2700
Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-GFGCCE

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      ?????? - ??????#9553-01.com

    • Size

      657KB

    • MD5

      bdf0580d6cf3a59b15f5817437a6c5a5

    • SHA1

      c3de15533c82e6a56975c3a5aa42ca88ec431cb2

    • SHA256

      133891fc02269ee06eb3e6ab1f20391fe1486cd5620f766c85b8fceaf223dc84

    • SHA512

      936570aa56de42c565b87730ca76f6e006a8278ad893a19286f61295da4656eeaaa88ae1d684af6bc961f8af9d7b74249e5ee7f4f3d78e68cb271b8860f967d0

    • SSDEEP

      12288:5XJ5r639UgrDDIVWN+YP7924lgRgPetEsVtDZoeDl51SKd0714/A:r5r6//DIVWUYj925RgPetEsVcy51pd0x

    Score
    10/10
    guloaderremcosremotehostcollectiondiscoverydownloaderratspywarestealer

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Detected Nirsoft tools

      Free utilities often used by attackers which can steal passwords, product keys, etc.

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook accounts

      collection

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks