Overview

overview

10

Static

static

3

Paymanet-S...df.exe

windows7-x64

10

Paymanet-S...df.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    31e0cd7edfc93d1dc62c9698e148d6251312de5e0a9e9aad25aa72d8a4b859be

  • Size

    1.1MB

  • Sample

    250216-xnsp4svrfn

  • MD5

    e4cbee81c6f43fd4fe92aab3eef681f7

  • SHA1

    c01f2681c1ef3cd2565e3b4013f92f8738d757f1

  • SHA256

    31e0cd7edfc93d1dc62c9698e148d6251312de5e0a9e9aad25aa72d8a4b859be

  • SHA512

    bad72a179b74d1203392edc09b4a1f32efe438a605b41a4c4eb599626fa78b883b921a62fa50e371e17419f49263a6be7ac0f486028c8bc270ee9196bcbe0547

  • SSDEEP

    24576:x/V62MfZX3vAHhC2RfZTs+TnpFNXrcAAoRhBSF0W3xkjdBuEu1zVun+0g5:XMF3vUhVRfZw+T17cr2hmDwdkRpc0

Score
10/10
remcosfeb 16discoveryexecutionrat

Malware Config

Extracted

Family

remcos

Botnet

FEB 16

C2

austin99.duckdns.org:9373

103.186.117.61:9373

heksaa3030.redirectme.net:9373
Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-YHG6AC

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      Paymanet-Slip...pdf.exe

    • Size

      1.3MB

    • MD5

      2c517ece7a49eb26047fcd73720b2fb7

    • SHA1

      35bbc93759262ef512535133cd09999994fa661e

    • SHA256

      bdfa0dac2858c88c72846b9e0df321db883b43e3004c25b5fed3a3d132ff1452

    • SHA512

      513c2a26218d2a7acc82e38a625bfae8ce69e09f75975fb6135d0c0f34a9552bacefa13836d3188222d00acf5e4b2c18317ac2384e92f010c95e7a9a0c6ece77

    • SSDEEP

      24576:JaHUIpi9GSVmtaS/l4RQVc4WP17DgVGsMbWzim0CY8iMo6btj:JaHUIpaGS1S/l4RZZvgV/Lg8iMJB

    Score
    10/10
    remcosfeb 16discoveryexecutionrat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Remcos family

      remcos

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks