General

  • Target

    WaveSourceInstaller.exe

  • Size

    469KB

  • Sample

    241218-y6q5nszrct

  • MD5

    e468b718e67495ea73c85d8258059adf

  • SHA1

    dcad70f5c39ab85f900ef1288067dbf51eaeb503

  • SHA256

    fa9f629254a8bbe915bbd587c0c060de580a18992103858a1d16686de8bd717e

  • SHA512

    b4eb6cc848b5ebfc6bab7e1cc033ec468bc8cf2fed72ea912f9fc60d6eaab75664f4627646960dccab2aceefeab9c5acbd2fe1b57d992c62358929b4d840dedb

  • SSDEEP

    12288:Wmnk7iLJbpIpiRL6I2WhSKQ9ZsfZQSJn9:uiLJbpI7I2WhQqZ7J9

Malware Config

Extracted

Family

remcos

Botnet

WaveSourceLeaked

C2

204.10.194.175:4444

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    true

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-46FS9Q

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      WaveSourceInstaller.exe

    • Size

      469KB

    • MD5

      e468b718e67495ea73c85d8258059adf

    • SHA1

      dcad70f5c39ab85f900ef1288067dbf51eaeb503

    • SHA256

      fa9f629254a8bbe915bbd587c0c060de580a18992103858a1d16686de8bd717e

    • SHA512

      b4eb6cc848b5ebfc6bab7e1cc033ec468bc8cf2fed72ea912f9fc60d6eaab75664f4627646960dccab2aceefeab9c5acbd2fe1b57d992c62358929b4d840dedb

    • SSDEEP

      12288:Wmnk7iLJbpIpiRL6I2WhSKQ9ZsfZQSJn9:uiLJbpI7I2WhQqZ7J9

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

    • Remcos family

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.