Overview

overview

10

Static

static

5

RFQ_PO-202...er.exe

windows7-x64

10

RFQ_PO-202...er.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f985bb55f655941d413a048cce0c40ac17d4012b345ff88cfb456f51c6928f61

  • Size

    2.7MB

  • Sample

    241014-dyh4wa1gqk

  • MD5

    90ed3d45fa300de5522087589ab658ee

  • SHA1

    a7911e6664f1b6ed2276eb7050c6417a1ed6ace0

  • SHA256

    f985bb55f655941d413a048cce0c40ac17d4012b345ff88cfb456f51c6928f61

  • SHA512

    3af93a9bb3561a77e7d1ca66aa5490ad8e62f9b7755d05e6d95abefd3b3c24cdc5e9fb7acc32e06627148e79d48e83dc129377a4ce051eb2916e2b2747c07548

  • SSDEEP

    49152:2wOZI8lH89v9NE5rmMAlUqjWKWu1b/q1w0rONSYFjCwf8QhINZm5QyTKCrRWAP:2wOe8lH89FK6JjW8Q1hrdYFjwQhIN6RT

Score
10/10
remcosremotehostcollectiondiscoveryratspywarestealer

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

204.10.160.212:6622

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-98KSNN

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      RFQ_PO-20240320_HYU SO#224934972​_10-14-2024_Order.exe

    • Size

      3.1MB

    • MD5

      29efaa947827fdf7c2e073d722e2e9ed

    • SHA1

      63fdea3a572f3da72828a8b9c24b7597e191c38e

    • SHA256

      0b0e015a5d60e901e68488e46635be7b45c34d80314cc95c71f45985b5fb1e1c

    • SHA512

      435f53792bd4541f39f9ed62fa7438231bf2c3420e6c12f8589c110ae22ad7ced6cb253ff7cb31caa2f838c65bc5c188b72321b0b4a03452a539cb25544c2aef

    • SSDEEP

      49152:t3v+7/5QgVx5vEjriM0lOqjAyWUlHj8TwyBOBSYF7C4fCQrIHZM5oITGMdnWcG:t3v+7Zv+mFjAGiTBBTYF7MQrIHMHdWcG

    Score
    10/10
    remcosremotehostcollectiondiscoveryratspywarestealer

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook accounts

      collection

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks