Overview

overview

10

Static

static

3

LPO.exe

windows7-x64

1

LPO.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    df1ce57d118d1faa90947dd479a093cb991fbd8a68e2787ca0672d1d952197ce

  • Size

    837KB

  • Sample

    241111-kv7fmawhrj

  • MD5

    8ac0170334b427d3c3da50c75296fd42

  • SHA1

    769eb26fc7d078103e62d9010bb8953be3563fff

  • SHA256

    df1ce57d118d1faa90947dd479a093cb991fbd8a68e2787ca0672d1d952197ce

  • SHA512

    a8ed99fa837c07e72366a2ee98b2f8786ab06aa7afd192c230b75d65204cbfa462de1a19bb411ddb2abe077bc4b1bc2be03dac284c61d1a5cd4274a8380ce710

  • SSDEEP

    24576:3nY0yVrD+LIM5r7De/c4uh3pSKLA0/Jdn2+JZDI:o0yV2fiAyK3JdnlZE

Score
10/10
remcosgasplantdiscoveryevasionexecutionrattrojan

Malware Config

Extracted

Family

remcos

Botnet

GASPLANT

C2

dotatech.de:30908

Attributes
  • audio_folder

    MicRecords

  • audio_path

    ApplicationPath

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    chrome-SYTYBI

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      LPO.exe

    • Size

      3.7MB

    • MD5

      b153c9fd78a67b3dd7153be08578854b

    • SHA1

      543590bc927b67e643cd2a20926f0633adca896b

    • SHA256

      76c67a9a7f86000d03ecca3a53412616677be7841755bccb6b1b988568b8fa3e

    • SHA512

      3828a518c99f8e7352157689c4f22014bad7c8868a831fd8bf4d875eff3048bd3804e74e8dffb8be4d70ac69a324a5070c8571d4441ec15f334f08f7bc38d4a4

    • SSDEEP

      12288:8EsEqWDSTFM2Txgi4bEcxpzYiwpb5ZaHhhx8FNA+fyXETyTyt8spi6ixg4dW:9qWD0MsgbZp8yzmbA+fJTyTytxpqzk

    Score
    10/10
    remcosgasplantdiscoveryevasionexecutionrattrojan

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Remcos family

      remcos

    • UAC bypass

      evasiontrojan

    • Windows security bypass

      evasiontrojan

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Windows security modification

      evasiontrojan

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks