Overview

overview

10

Static

static

5

RFQ_PO HYU...NS.exe

windows7-x64

10

RFQ_PO HYU...NS.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    42a49d144c35d82294c38085b4a877dc9bcce8f3fe9d02be13163cebb409e3cd

  • Size

    2.6MB

  • Sample

    241011-clsbcazejh

  • MD5

    816ff6ad37b1a1aa1b8b2e81ebb20d78

  • SHA1

    e495a26e8672d309078e01b37939a53d847054c4

  • SHA256

    42a49d144c35d82294c38085b4a877dc9bcce8f3fe9d02be13163cebb409e3cd

  • SHA512

    5f6612722a802eb35cb207881ef743d9ab4a43e589df350249245edbd79f4eecb6eccd60fbd33955a313d27f4d3095bc17ab3154ded685a0f43b75b2603bb4d1

  • SSDEEP

    49152:rDVymyNgg784IX+1/pGBHMKgs7J30NQpbmcVCCcrIePZqMMzjpK/dA2Tsoe/u:rDVXyag78rXeMgsd34GFQWnGh1eW

Score
10/10
remcosremotehostcollectiondiscoveryratspywarestealer

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

204.10.160.212:6622

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-98KSNN

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      RFQ_PO HYU0839_MQ0982830_ORDER_SPECIFICATIONS.exe

    • Size

      3.1MB

    • MD5

      7acf208141e845dd90dce0c54ce2206e

    • SHA1

      f80762c234f34f4672cda463fb3587e89171d9f9

    • SHA256

      1ec99e4c08597dc688ec4f2558481da34d503f7b34e344ceb53ba37d7d5727e4

    • SHA512

      1756192d3232e223eb40a431b105fc9da1d270a6b3ca294bdb8ea4fba39e56097ada36ae9fec1d28f3f984d5ce54ed4edd6a31758eefc7668abc50cf17236742

    • SSDEEP

      49152:D3v+7/5QXTOsgVwEqBYB/peBb66gMZJ90TU3x+cta0cxI4JpqgMzj9epd+MVaEeP:D3v+7qSsgVwdBiygMr9gi/SozUHveP

    Score
    10/10
    remcosremotehostcollectiondiscoveryratspywarestealer

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook accounts

      collection

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks