Overview

overview

10

Static

static

5

new.exe

windows7-x64

7

new.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2F85CE42656457CDEC39992649B81F76

  • Size

    965KB

  • Sample

    250204-kqsfxa1qds

  • MD5

    2f85ce42656457cdec39992649b81f76

  • SHA1

    f3ebac472af8660bbde4679bc047a4fcc7243bdf

  • SHA256

    35afd6971fb23d04f2bf72d505cb4bcd956c7b97ba002495a071fb94686969e7

  • SHA512

    94ad687c70bf7378a32b26b4b72b9318953350b1940e75b873e41af33a10fc065e1efd69398fd7dd02cf6f0903b2e34676d092dbc28c4ce8f940c200798b286d

  • SSDEEP

    24576:6s/7jP+lFB43jXGH5/ajmUcb0v3AtR8a/HoL8rf0XW:6sDjYFy3iUjmUx/MRdwADiW

Score
10/10
remcosremotehostdiscoverypersistencerat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

192.3.64.152:2559

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    true

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-EPD71P

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      new.exe

    • Size

      1.4MB

    • MD5

      9549b9ff42af2fdd1943a1cb5e41baff

    • SHA1

      bf30c30071ea553e0bc2a01aa2ebad1d2cef8868

    • SHA256

      f0890236561509ebdba4da6afbd92c6684a454c80edecba802f7e72cdfa6db6b

    • SHA512

      1ce8671893d354b5ec340ef03ad5583216e1d1a6191442fd5368a353d2515810afdb5dee2f29801e018de6736c0667fee6ec1961e7af04b3e6ab66346c30aaca

    • SSDEEP

      24576:KqDEvCTbMWu7rQYlBQcBiT6rprG8aLxnmUItiv3cXziE1ToL8X/6P:KTvC/MTQYxsWR7aLxnmUj/Oz72Av

    Score
    10/10
    discoveryremcosremotehostpersistencerat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Remcos family

      remcos

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks