Overview

overview

10

Static

static

1

8140d8019e...68.vbs

windows7-x64

8

8140d8019e...68.vbs

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8140d8019e144b3998a9fc991c45be89eb5f83c58f04627ce34c49b3f8d5d368.vbs

  • Size

    499KB

  • Sample

    241002-dy7ggaydke

  • MD5

    4a31a1de3d99c80d908ddda051e2f761

  • SHA1

    302e19edb2c96cc78cb866c2d78d7f2fc77e8297

  • SHA256

    8140d8019e144b3998a9fc991c45be89eb5f83c58f04627ce34c49b3f8d5d368

  • SHA512

    8a35d105e2c6021fa81e86ca610614867f3165d261c1b9f92f236a497698475b3c6e072b950f8aabeea4831be446f36e2cf4335d306834d987b46d0a5867d284

  • SSDEEP

    12288:W5Fy+b4KOMEA35NC3O6xGYIWO2hnf/us6fM/cgXruE528e7XRPa2d+dbw3Td57g:Wu+GGGxv/HL8o

Score
10/10
remcostsostdiscoveryexecutionrat

Malware Config

Extracted

Family

remcos

Botnet

TsosT

C2

23spt.duckdns.org:3000

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-DCR6HW

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      8140d8019e144b3998a9fc991c45be89eb5f83c58f04627ce34c49b3f8d5d368.vbs

    • Size

      499KB

    • MD5

      4a31a1de3d99c80d908ddda051e2f761

    • SHA1

      302e19edb2c96cc78cb866c2d78d7f2fc77e8297

    • SHA256

      8140d8019e144b3998a9fc991c45be89eb5f83c58f04627ce34c49b3f8d5d368

    • SHA512

      8a35d105e2c6021fa81e86ca610614867f3165d261c1b9f92f236a497698475b3c6e072b950f8aabeea4831be446f36e2cf4335d306834d987b46d0a5867d284

    • SSDEEP

      12288:W5Fy+b4KOMEA35NC3O6xGYIWO2hnf/us6fM/cgXruE528e7XRPa2d+dbw3Td57g:Wu+GGGxv/HL8o

    Score
    10/10
    executionremcostsostdiscoveryrat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks