remcos | 6569bc42cbe3905f6dd2105826c2d7c08d5a9a6606130e80ac01f6f31278fba8 | Triage

Sharing

General

Target

JaffaCakes118_6569bc42cbe3905f6dd2105826c2d7c08d5a9a6606130e80ac01f6f31278fba8
Size

835.9MB
Sample

241222-dlcrbs1lay
MD5

6de68ff3f2e0ecf720905f783e707912
SHA1

d921abe997537273ba1133a0afa95271f397b25e
SHA256

6569bc42cbe3905f6dd2105826c2d7c08d5a9a6606130e80ac01f6f31278fba8
SHA512

028dff1eecc6e1ae77c259c666dcc34b0c65499e37a9b1ff56b7af4db33dc07ede7f7678978f6211fa11052577a0539e911e49962d2a5bc129a0ed0c351e277d
SSDEEP

12288:IeUcz27ubdMrMTjgddDxE6hCsfaG5Mcsp6A/MdfExobHbLYuK:BU+jM2gd1KOCsiArg6EVAYuK

Score

10^/10

remcos zip discovery rat

Malware Config

Extracted

Family

remcos

Botnet

ZIP

C2

gfkodssnvosdjvlksnvldkj.con-ip.com:1883

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-O0ZE3X
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Targets

- Target
  
  JaffaCakes118_6569bc42cbe3905f6dd2105826c2d7c08d5a9a6606130e80ac01f6f31278fba8
- Size
  
  835.9MB
- MD5
  
  6de68ff3f2e0ecf720905f783e707912
- SHA1
  
  d921abe997537273ba1133a0afa95271f397b25e
- SHA256
  
  6569bc42cbe3905f6dd2105826c2d7c08d5a9a6606130e80ac01f6f31278fba8
- SHA512
  
  028dff1eecc6e1ae77c259c666dcc34b0c65499e37a9b1ff56b7af4db33dc07ede7f7678978f6211fa11052577a0539e911e49962d2a5bc129a0ed0c351e277d
- SSDEEP
  
  12288:IeUcz27ubdMrMTjgddDxE6hCsfaG5Mcsp6A/MdfExobHbLYuK:BU+jM2gd1KOCsiArg6EVAYuK
Score

10^/10

remcos zip discovery rat
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Remcos family
  remcos
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Scheduled Task

Persistence

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Scheduled Task/Job

Scheduled Task

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

remcoszipdiscoveryrat

behavioral2

remcoszipdiscoveryrat