Overview

overview

10

Static

static

5

80d9d24c7c...f7.exe

windows7-x64

10

80d9d24c7c...f7.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    80d9d24c7cfd67002614e2f5a212175946386f889eddda66f6e7a423f9bbf8f7.exe

  • Size

    1.0MB

  • Sample

    241117-c3tkqszamr

  • MD5

    3ac5c2f48370ff445ffb4f99c94014af

  • SHA1

    275c43f16565d071d0683471c3b6fd68d20fbbe2

  • SHA256

    80d9d24c7cfd67002614e2f5a212175946386f889eddda66f6e7a423f9bbf8f7

  • SHA512

    554258bf14b235fb229cb28778b1d1a5715c1c74c128c6f955567a00345e8e1c0736520649be9f8d02907aca838d018c55a5cf4f4cb27be119e8f7977a9b0504

  • SSDEEP

    24576:uRmJkcoQricOIQxiZY1iaCDH1MJ55AxaiKDeLRR:7JZoQrbTFZY1iaCLQ56aifT

Score
10/10
remcosoct 28discoveryrat

Malware Config

Extracted

Family

remcos

Botnet

OCT 28

C2

myhost001.myddns.me:9373

103.161.133.98:4804

103.161.133.98:9373

myhost001.myddns.me:4804
Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-47R6I4

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      80d9d24c7cfd67002614e2f5a212175946386f889eddda66f6e7a423f9bbf8f7.exe

    • Size

      1.0MB

    • MD5

      3ac5c2f48370ff445ffb4f99c94014af

    • SHA1

      275c43f16565d071d0683471c3b6fd68d20fbbe2

    • SHA256

      80d9d24c7cfd67002614e2f5a212175946386f889eddda66f6e7a423f9bbf8f7

    • SHA512

      554258bf14b235fb229cb28778b1d1a5715c1c74c128c6f955567a00345e8e1c0736520649be9f8d02907aca838d018c55a5cf4f4cb27be119e8f7977a9b0504

    • SSDEEP

      24576:uRmJkcoQricOIQxiZY1iaCDH1MJ55AxaiKDeLRR:7JZoQrbTFZY1iaCLQ56aifT

    Score
    10/10
    remcosoct 28discoveryrat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Remcos family

      remcos

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks