Overview

overview

10

Static

static

3

Purchase_O...df.exe

windows7-x64

10

Purchase_O...df.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    852d66d5591f06811aaf759534618454fd362a75dd76287f2a5e0cef4204ea2f

  • Size

    1.1MB

  • Sample

    250215-k25wdayjbx

  • MD5

    02ffc3c519f62d5b8ef1d4630fa66c58

  • SHA1

    1c418d194b8da7766b25c4e50ecac2f207004fa2

  • SHA256

    852d66d5591f06811aaf759534618454fd362a75dd76287f2a5e0cef4204ea2f

  • SHA512

    e2167162df29f1055cef0600b51fdfc7cf34563e1347ec82563590906aa84325c7aec46c26ccc24306c6c57e2e9a50d4759adb606d7d03184237b34480c89e60

  • SSDEEP

    24576:kUFPPcu9KUWhPUnSRqqMKffcRynJKvxJia4mpbSiYysqY5/Y:D+UWhKpiHcrxJiPmp1Ytg

Score
10/10
remcosfeb 13discoveryexecutionrat

Malware Config

Extracted

Family

remcos

Botnet

FEB 13

C2

oktoviyanto.ddns.net:9373

103.186.117.61:9373

benhenry2234.zapto.org:9373
Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-MK1WZA

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      Purchase_Order..pdf.exe

    • Size

      1.3MB

    • MD5

      46490b8654c6394699068d3ae30b08fc

    • SHA1

      b8960be905f7791568986df1097baafa59fecde6

    • SHA256

      514f3fb022c7a2eb384e4764642e133e651c4e14bd19e513c4609b550a676bff

    • SHA512

      85abd72ff66a13813bf0d80d6a24b54d22031e589cd27668af7beeaed38910e9e7a2a5fd705fa415f465faabb0c63881d397f7228acb16ac52930269517efddd

    • SSDEEP

      24576:ZaHUI8e+FBJTraWpnqN3H/jnMN1cOVEi0v5d+jTs6im0CY8iMo6btf:ZaHUI8e+FBJXaWpqN3YNlVL0v5d+jTa8

    Score
    10/10
    remcosfeb 13discoveryexecutionrat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Remcos family

      remcos

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks