Overview

overview

10

Static

static

3

GK098765000900000.exe

windows7-x64

10

GK098765000900000.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1069A139A78B770241AEFB5AD527756B

  • Size

    829KB

  • Sample

    250204-kqkfastjep

  • MD5

    1069a139a78b770241aefb5ad527756b

  • SHA1

    f8512ad556175386eed0901b69cb2629edffc03c

  • SHA256

    4cbaba0f916064b426dfd3b2b5a86c1c69c3ead978c3d143e05b88a536b29cfd

  • SHA512

    720497bd202b8750c7ebc840772fb917ec2f04f6f46f7aba21f3906307a38fa112f0b766f5b8b99858ba96d35f776be2919658e1133d2b22cf7b7de9b38f0492

  • SSDEEP

    24576:EnVuXAzejvke6ExnpOICc9Xvi10UU2xrcinnHetZd:EnsXwovkPYpOQRe0l2Zcinn+

Score
10/10
remcosjohn-pcdiscoveryexecutionrat

Malware Config

Extracted

Family

remcos

Botnet

JOHN-PC

C2

107.175.229.139:8087

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-IN4YDY

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      GK098765000900000.bat

    • Size

      852KB

    • MD5

      16d59170db4782c9bba800a67dc79644

    • SHA1

      1856e628a3779d775868403692c44afae8f061f0

    • SHA256

      d02b26fd892d539b931cc6949e1faad954e1febb629d5398a44ba252f7814e87

    • SHA512

      6833b84035d24e35051492a8c5bec84035dacb36448239272e66e71df19b775eb7fd8af921d5379ad2d324eebe46c8ac5237a33b33e88b89d115b7b1390a5bb7

    • SSDEEP

      24576:kSfQzi/Pi+jnpOI2mDhFiR0UMmRtuexCjASZ:kSfAqPiupOyj00Lm3ueojhZ

    Score
    10/10
    remcosjohn-pcdiscoveryexecutionrat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Remcos family

      remcos

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks