Overview

overview

10

Static

static

5

ENQ02344.exe

windows7-x64

10

ENQ02344.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    288362fe0cf3682c218fd476a7ff4d7ab5abd56703fb7c5ec1ec0229193fd602

  • Size

    858KB

  • Sample

    241219-fqx9yazrdr

  • MD5

    191876f88f63718acb4581ed18be3a7f

  • SHA1

    40eb2b79c7cfc6a2737e5b3cb4ddf3cd79c38a16

  • SHA256

    288362fe0cf3682c218fd476a7ff4d7ab5abd56703fb7c5ec1ec0229193fd602

  • SHA512

    3d80468f88d1e32727a8ffdab6e044d179542f6275b004d87519b73cb597927fa067935417ad3cb885e8245e4bd9b771ce2cb4f12b05eb7a094107b29d906d7e

  • SSDEEP

    24576:AFFAJHAm3eyFCzhFlqs0SWi545QqvEDm8TUhP50s4gM:cFJTUHtJEm/HCj

Score
10/10
remcosremotehostdiscoveryrat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

192.3.64.152:2559

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-ZFXG9Y

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      ENQ02344.exe

    • Size

      1.3MB

    • MD5

      db6377387e0216c9cac9f54226a3b932

    • SHA1

      722abe694938d5da9e66b603d7677594efa8b3ee

    • SHA256

      8ab3354b91361d4860265097706bff6c4bfe578002fd53a92072f2fa1e123116

    • SHA512

      bb94a414b98f39fa7823c8f71a80dea169996274cffff0e520dd28d7cf627a5604305495c6466b900b836951166f092fe4b952458acfb973772b79d5baa5159f

    • SSDEEP

      24576:yqDEvCTbMWu7rQYlBQcBiT6rprG8atQta3kD+OnqH0pm/J7u2f:yTvC/MTQYxsWR7atUD+OqH0pm/k

    Score
    10/10
    remcosremotehostdiscoveryrat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Remcos family

      remcos

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks