Overview

overview

10

Static

static

1

bible.txt

windows7-x64

1

bible.txt

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bible.txt

  • Size

    225KB

  • Sample

    241218-ze29as1rek

  • MD5

    98b8b1156c117525c118b45b2d3dbb06

  • SHA1

    82e9026c65919215effd3b1a2419250d04d52889

  • SHA256

    1efdf886a13a5beabfb3071f9ec40c35cbd98d87792894bc272fab8718c2a5b6

  • SHA512

    b043033b6e7e339d24de655092770a22616be15fba71697e3c42f1296225936704f303e1f27da7a4d122a3f403ccc9db95631920245fe332848c78b2c3a5a768

  • SSDEEP

    3072:b34/ch8l09xOXYnh8B0b3it9za72jnSSLIamumy0nC/xgjizOuV5m37mqzN09khO:b7he0+RVptmy0CpLb5yLO

Score
10/10
remcoswavesourceleakeddiscoverypersistencerat

Malware Config

Extracted

Family

remcos

Botnet

WaveSourceLeaked

C2

204.10.194.175:4444

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    true

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-46FS9Q

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      bible.txt

    • Size

      225KB

    • MD5

      98b8b1156c117525c118b45b2d3dbb06

    • SHA1

      82e9026c65919215effd3b1a2419250d04d52889

    • SHA256

      1efdf886a13a5beabfb3071f9ec40c35cbd98d87792894bc272fab8718c2a5b6

    • SHA512

      b043033b6e7e339d24de655092770a22616be15fba71697e3c42f1296225936704f303e1f27da7a4d122a3f403ccc9db95631920245fe332848c78b2c3a5a768

    • SSDEEP

      3072:b34/ch8l09xOXYnh8B0b3it9za72jnSSLIamumy0nC/xgjizOuV5m37mqzN09khO:b7he0+RVptmy0CpLb5yLO

    Score
    10/10
    remcoswavesourceleakeddiscoverypersistencerat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Remcos family

      remcos

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks