Overview

overview

10

Static

static

1

SC__TR1160049907.js

windows7-x64

10

SC__TR1160049907.js

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    17022025_1253_SC__TR1160049907.js.gz

  • Size

    2KB

  • Sample

    250217-p9agnayrcj

  • MD5

    af21b3379346e79e0046f93f7b66f973

  • SHA1

    a1ffe4cfa2dd2deb978a720c4d7b3692e50aeaba

  • SHA256

    2070ce444a8c4c0f646e4c82f613c34e1c2b0b578e98460bed6ee637fb599684

  • SHA512

    6419fee2cbdd2a62588bfd85d0801beb256733667ff3324dc9bfd9e7ea39ab4e0d3f6a3447166ce24ab5b22f3d2f44f41637e958fa30d8786a4826effe9dad3a

Score
10/10
remcosooddiscoveryexecutionrat

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://3005.filemail.com/api/file/get?filekey=nIx_5T0LxHOBjilNb9CRviabPjrW2dlC-LxeOdJPF_Z_1MP6CuQBS5KcptA&pk_vid=342803d1cc4e3b801739359203b5fe9d
exe.dropper

https://3005.filemail.com/api/file/get?filekey=nIx_5T0LxHOBjilNb9CRviabPjrW2dlC-LxeOdJPF_Z_1MP6CuQBS5KcptA&pk_vid=342803d1cc4e3b801739359203b5fe9d

Extracted

Family

remcos

Botnet

ood

C2

goody.work.gd:4173

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    vlc

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    true

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    ios

  • mouse_option

    false

  • mutex

    gig-R8G1B2

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    sos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      SC__TR1160049907.js

    • Size

      84KB

    • MD5

      dff301df2596bec9d7e48c740d78292e

    • SHA1

      9121cae742a8c8d38d8a87ba94d28bcfd8c40eb6

    • SHA256

      587201f98c6d3aac49ba4637ecab3e1fcacb4a276f4528a123e6e64bce9fb30d

    • SHA512

      d827d8a7f950c9884839a9d3d7588d77865cb542ba8b0e4901ad820ab9a79b941ac505ef37948a4dc504bde6248216e38c95cf54db45d8c6627efcb239c94882

    • SSDEEP

      384:HZB5abdZB5abtZB5abdZB5abozZB5abtZB5abdZB5ab8ZB5abtZB5abdZB5ab3ZG:8Vl

    Score
    10/10
    executionremcosooddiscoveryrat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Remcos family

      remcos

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks