Overview

overview

10

Static

static

5

510DA872B9...45.exe

windows7-x64

7

510DA872B9...45.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    510DA872B991223204159A3A2DB2C354990961A1131090FDE23D9FDE8C18C245

  • Size

    1.4MB

  • Sample

    250103-jpxhssxphm

  • MD5

    27b2117dd7b51a94fabfa5b69f8e24cd

  • SHA1

    75ae30e656f11222f42e4343c18b8651b5e091f2

  • SHA256

    510da872b991223204159a3a2db2c354990961a1131090fde23d9fde8c18c245

  • SHA512

    542524baf4d912f962c40dd3e873052cad2f2dda34bc8e3eb5a7561487a07abc1f1da87db5f239d65f9f7fa50845fba16639d85f0e5cddca0d35edee0bbec258

  • SSDEEP

    24576:hAHnh+eWsN3skA4RV1Hom2KXMmHa3syoNcW9e4Lzt8kZ31p5:4h+ZkldoPK8Ya3+9v8kZ39

Score
10/10
remcosremotehostdiscoveryrat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

127.0.0.1:44999

127.0.0.1:54991

africarem.duckdns.org:54991

africarem.duckdns.org:44999
Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-KK3NDA

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      510DA872B991223204159A3A2DB2C354990961A1131090FDE23D9FDE8C18C245

    • Size

      1.4MB

    • MD5

      27b2117dd7b51a94fabfa5b69f8e24cd

    • SHA1

      75ae30e656f11222f42e4343c18b8651b5e091f2

    • SHA256

      510da872b991223204159a3a2db2c354990961a1131090fde23d9fde8c18c245

    • SHA512

      542524baf4d912f962c40dd3e873052cad2f2dda34bc8e3eb5a7561487a07abc1f1da87db5f239d65f9f7fa50845fba16639d85f0e5cddca0d35edee0bbec258

    • SSDEEP

      24576:hAHnh+eWsN3skA4RV1Hom2KXMmHa3syoNcW9e4Lzt8kZ31p5:4h+ZkldoPK8Ya3+9v8kZ39

    Score
    10/10
    discoveryremcosremotehostrat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Remcos family

      remcos

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks