Overview

overview

10

Static

static

10

4988-65-0x...ry.exe

windows7-x64

1

4988-65-0x...ry.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4988-65-0x0000000001200000-0x0000000002200000-memory.dmp

  • Size

    16.0MB

  • Sample

    250217-tbsb2azpcr

  • MD5

    3025b582171acf84190c70e0c88fe2ce

  • SHA1

    3e7568f80968ff5e3763da6096773dcbf9fa95bb

  • SHA256

    ca0db041376d0c4aff26dc44264d5a7cac3dd1af4b8b631324265e1aaec8f2f4

  • SHA512

    c30ba90f8268b1f7ea940fba5e3b16e63821e6ff53098e07f457a0e677ccfb29622c882c296fddb41dd7fa0351d932551d44ddc7c4d7b01aa127d303016baa1b

  • SSDEEP

    12288:xxddto3kVuGm/7vDD3YAQr54outsvZ4IaS:3ddtqkVuH/L654oDZ/a

Score
10/10
remcosyakuze firewalldiscovery

Malware Config

Extracted

Family

remcos

Botnet

Yakuze Firewall

C2

103.186.117.159:48453

pentester03.gleeze.com:28438

pentester0.accesscam.org:56796

honeypotresearchteam.duckdns.org:28453
Attributes
  • audio_folder

    MicRecords

  • audio_path

    ApplicationPath

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    WeChat.exe

  • copy_folder

    wechats

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    sharepoint-YH5JCI

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      4988-65-0x0000000001200000-0x0000000002200000-memory.dmp

    • Size

      16.0MB

    • MD5

      3025b582171acf84190c70e0c88fe2ce

    • SHA1

      3e7568f80968ff5e3763da6096773dcbf9fa95bb

    • SHA256

      ca0db041376d0c4aff26dc44264d5a7cac3dd1af4b8b631324265e1aaec8f2f4

    • SHA512

      c30ba90f8268b1f7ea940fba5e3b16e63821e6ff53098e07f457a0e677ccfb29622c882c296fddb41dd7fa0351d932551d44ddc7c4d7b01aa127d303016baa1b

    • SSDEEP

      12288:xxddto3kVuGm/7vDD3YAQr54outsvZ4IaS:3ddtqkVuH/L654oDZ/a

    Score
    8/10
    discovery

    • Downloads MZ/PE file

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks