General

  • Target

    b9fdce90b71b584cc85d90027dc206949a6d92cf92159112e2f96f5578fc78b7.exe

  • Size

    955KB

  • Sample

    241205-dp2vmawkas

  • MD5

    52c642cdb7298bb11558da681d352978

  • SHA1

    5ffacf37fb2e05b0c7078f89554e949afd369318

  • SHA256

    b9fdce90b71b584cc85d90027dc206949a6d92cf92159112e2f96f5578fc78b7

  • SHA512

    daf8b97540c58b58a86a2e73fc907ced0ba332d19811047491d59ae40ce53dc9ed613773b107da5fb8d96b59c1247a18b35eb5fbe4c8be2b016f65a80594f7d0

  • SSDEEP

    24576:0IeeIW8rjYO/CjNIvTc4ST4AWptCaWaZldbmi+3I:0BeBLhIvwHkB7CfaNdc

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

ddpo.duckdns.org:59033

Attributes
  • audio_folder

    MicRecords

  • audio_path

    ApplicationPath

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-NUED7N

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      b9fdce90b71b584cc85d90027dc206949a6d92cf92159112e2f96f5578fc78b7.exe

    • Size

      955KB

    • MD5

      52c642cdb7298bb11558da681d352978

    • SHA1

      5ffacf37fb2e05b0c7078f89554e949afd369318

    • SHA256

      b9fdce90b71b584cc85d90027dc206949a6d92cf92159112e2f96f5578fc78b7

    • SHA512

      daf8b97540c58b58a86a2e73fc907ced0ba332d19811047491d59ae40ce53dc9ed613773b107da5fb8d96b59c1247a18b35eb5fbe4c8be2b016f65a80594f7d0

    • SSDEEP

      24576:0IeeIW8rjYO/CjNIvTc4ST4AWptCaWaZldbmi+3I:0BeBLhIvwHkB7CfaNdc

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

    • Remcos family

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.