Overview

overview

10

Static

static

3

40f06c637a...e06.gz

windows7-x64

7

40f06c637a...e06.gz

windows10-2004-x64

10

800399031-...df.exe

windows7-x64

10

800399031-...df.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    40f06c637aab5f71d01f1e83e35fc68e36e1ce06.gz.tar.gz

  • Size

    937KB

  • Sample

    241121-rlv5kaspcy

  • MD5

    8972d2ff35092d275e61af92d99ed13f

  • SHA1

    d1cff55ba1362f9f5c256366fb8fdd6a051ed553

  • SHA256

    3f964066e50b9c6a685c0fb08cf2c89da26149fcd237a5de9789212a5d962d5d

  • SHA512

    3204699eabc448752da0924ee697a39823f8e9a24c3ad5aa9ed5bf1b71f56aa276fad37b37fed23df5ac38958dd0d9c19fe2b36a23ba5af5d5ed5609328f33bd

  • SSDEEP

    24576:Lam4xFHF4756Ctcbz63YY3XDqJJBUiIkpzpF+agQ:vqOYCtci3YtTBUipV9

Score
10/10
remcoshostdiscoveryrat

Malware Config

Extracted

Family

remcos

Botnet

Host

C2

oyo.work.gd:3142

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    vlc

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    true

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    pdf

  • mouse_option

    false

  • mutex

    jkm-I9KENP

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    ios

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      40f06c637aab5f71d01f1e83e35fc68e36e1ce06.gz

    • Size

      939KB

    • MD5

      0bc9c53a5ab3751ae26c126f9570331a

    • SHA1

      40f06c637aab5f71d01f1e83e35fc68e36e1ce06

    • SHA256

      18fd9d6f7a1c06ffafc021a893b4d374b0167ad412a44f8695f0a6c191e1f945

    • SHA512

      2a96a5d5e8200de1f089d1a3d0b6867a0ecbdb8df7cd61001e27fa7c7485dfce96f860c4efd8c794cc2e401f2feeaaca2baffd04180c2fc49c410fec379d7f82

    • SSDEEP

      24576:MrPkzH6GbaiKIrWM8kXBtR4mZhHUagn4/icouRK:M26lzIR5XBH4mPHUaQ4/icd0

    Score
    10/10
    discoveryremcoshostrat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Remcos family

      remcos

    • Executes dropped EXE

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      800399031-18.11.2024.pdf.exe

    • Size

      1.2MB

    • MD5

      45894c9891ec824514cac826a7cf310d

    • SHA1

      f31c98e48e07bce2db4baefbba0d61f9448635a5

    • SHA256

      74187b7287a272af25f995d7f5e1a124eace0f38d497b8672e2a02df5343b6bf

    • SHA512

      4a240d09bc14b6b25d61bbf639631a7f5684dcf1f262df93bfd336ade2a0ed62bed72485d596df6e8a667183fcd8171f54cd786f5cb36a5982b1177760ae3634

    • SSDEEP

      24576:Noij0HzKJzxWsabaQQobsoEuLB3TIm9zXyisECCr:ozK7WsxnozBLBDImpXyiSCr

    Score
    10/10
    remcoshostdiscoveryrat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Remcos family

      remcos

    • Suspicious use of SetThreadContext

    behavioral3behavioral4

MITRE ATT&CK Enterprise v15

Tasks