Overview

overview

10

Static

static

3

81ef49f096...f2.exe

windows7-x64

10

81ef49f096...f2.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    81ef49f096ce2f6c458daaa54e9d5b23643a594327fa0c2bfc85b55eb01c00f2.exe

  • Size

    7.2MB

  • Sample

    250110-c5tzaayqfz

  • MD5

    bea6a240b75b75fca5ca494a9e94bd28

  • SHA1

    918c6f37e7614bf766aa8b2d283b3063a2e120bb

  • SHA256

    81ef49f096ce2f6c458daaa54e9d5b23643a594327fa0c2bfc85b55eb01c00f2

  • SHA512

    e5fd1b7b618942b7b96651eb716a1d7265b09fe6a58a0fa5d225b9ff08d6cb5285a80f86ccb40b9d188b7940e0de3539d5f81ed20b2a815ab9e4d25078361960

  • SSDEEP

    196608:0xBE3yoXaY17w7D+ODM3OVAvULnItSx0USapM7oxBY:4r/Y9wD+ODdoULItsq

Score
10/10
remcossys32discoveryrat

Malware Config

Extracted

Family

remcos

Botnet

Sys32

C2

5.252.153.10:4447

Attributes
  • audio_folder

    MicRecords

  • audio_path

    ApplicationPath

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    true

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    Logs

  • keylog_path

    %UserProfile%

  • mouse_option

    false

  • mutex

    Sys32-YLZ2UJ

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      81ef49f096ce2f6c458daaa54e9d5b23643a594327fa0c2bfc85b55eb01c00f2.exe

    • Size

      7.2MB

    • MD5

      bea6a240b75b75fca5ca494a9e94bd28

    • SHA1

      918c6f37e7614bf766aa8b2d283b3063a2e120bb

    • SHA256

      81ef49f096ce2f6c458daaa54e9d5b23643a594327fa0c2bfc85b55eb01c00f2

    • SHA512

      e5fd1b7b618942b7b96651eb716a1d7265b09fe6a58a0fa5d225b9ff08d6cb5285a80f86ccb40b9d188b7940e0de3539d5f81ed20b2a815ab9e4d25078361960

    • SSDEEP

      196608:0xBE3yoXaY17w7D+ODM3OVAvULnItSx0USapM7oxBY:4r/Y9wD+ODdoULItsq

    Score
    10/10
    remcossys32discoveryrat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Remcos family

      remcos

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks