Overview

overview

10

Static

static

3

5e95fb52da...bN.exe

windows7-x64

10

5e95fb52da...bN.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5e95fb52da2144a06a66a593a6f12877108ebcdeb69f8f60ad010831d4fce1ebN.exe

  • Size

    1.0MB

  • Sample

    250212-wxkv7asjcj

  • MD5

    d2cdd24bdc88bd545fe5032be4b96740

  • SHA1

    33544c32241fbe5aee3c39040f7f627b3ad8ec54

  • SHA256

    5e95fb52da2144a06a66a593a6f12877108ebcdeb69f8f60ad010831d4fce1eb

  • SHA512

    72e833024ccd821515e58a0e8d07cbe658522cb3c7d5011f136d1c0559bf6ff6e646d0a7b16fcb109d251c0d5933d21100c9c442b6e3fb756cdc1ef51609d49c

  • SSDEEP

    24576:TjNsRGMg+QMoW6n+hNl1qbXqmAz08A3zptDAKuHdUnPpl:TBsF4m12afzVADptDluHaPp

Score
10/10
remcosooddiscoveryrat

Malware Config

Extracted

Family

remcos

Botnet

ood

C2

goody.work.gd:4173

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    vlc

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    true

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    ios

  • mouse_option

    false

  • mutex

    gig-R8G1B2

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    sos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      5e95fb52da2144a06a66a593a6f12877108ebcdeb69f8f60ad010831d4fce1ebN.exe

    • Size

      1.0MB

    • MD5

      d2cdd24bdc88bd545fe5032be4b96740

    • SHA1

      33544c32241fbe5aee3c39040f7f627b3ad8ec54

    • SHA256

      5e95fb52da2144a06a66a593a6f12877108ebcdeb69f8f60ad010831d4fce1eb

    • SHA512

      72e833024ccd821515e58a0e8d07cbe658522cb3c7d5011f136d1c0559bf6ff6e646d0a7b16fcb109d251c0d5933d21100c9c442b6e3fb756cdc1ef51609d49c

    • SSDEEP

      24576:TjNsRGMg+QMoW6n+hNl1qbXqmAz08A3zptDAKuHdUnPpl:TBsF4m12afzVADptDluHaPp

    Score
    10/10
    remcosooddiscoveryrat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Remcos family

      remcos

    • Downloads MZ/PE file

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks