Overview

overview

10

Static

static

1

DHL RPA GR...PDF.js

windows7-x64

10

DHL RPA GR...PDF.js

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    17022025_1651_17022025_DHLRPAGRBPTemplate.PDF.gz

  • Size

    2KB

  • Sample

    250217-vml5ts1jdx

  • MD5

    834cef755c9541a95ddba2a5927d1bcc

  • SHA1

    3446f3bd07cd739dd5f01cf236c01283acbd8992

  • SHA256

    f6d422f45cfdde668b5e7229844ff8a907ad97cc218ca45dff0747f3a79f871d

  • SHA512

    994007c6a004019c887ad879ddf282e1014aa7926f5ff495da9c335c21a08286539efd57099ca58102b04e63230e2dca94447de3fa91d1377c81445820e800f7

Score
10/10
remcosnomdiscoveryexecutionrat

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://3005.filemail.com/api/file/get?filekey=nIx_5T0LxHOBjilNb9CRviabPjrW2dlC-LxeOdJPF_Z_1MP6CuQBS5KcptA&pk_vid=342803d1cc4e3b801739359203b5fe9d
exe.dropper

https://3005.filemail.com/api/file/get?filekey=nIx_5T0LxHOBjilNb9CRviabPjrW2dlC-LxeOdJPF_Z_1MP6CuQBS5KcptA&pk_vid=342803d1cc4e3b801739359203b5fe9d

Extracted

Family

remcos

Botnet

nom

C2

meme.linkpc.net:3174

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    vlc

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    true

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    ios

  • mouse_option

    false

  • mutex

    gig-G7MMFK

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    sos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      DHL RPA GRBP Template.PDF.js

    • Size

      84KB

    • MD5

      27cb47b5e1ac316a34e346dc787782f6

    • SHA1

      70d3f484ab6ca95c0d03479894181a4fbb883583

    • SHA256

      abc914c82dac8f803df0ae50a350c38cd7af60344f60936a6df01198efbb03f6

    • SHA512

      1ecf1ed09e1df85fa7596d0ca169885d2f19a43d98c8309ad2d9a039c5c8489932410ed8af47d1dbfbeb421b97b6515afd722c7785eac6249f37e0f88c3f6b8f

    • SSDEEP

      384:HZB5abMZB5abtZB5abdZB5abvZB5abtZB5abdZB5abhZB5abtZB5abdZB5abTZBH:4

    Score
    10/10
    executionremcosnomdiscoveryrat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Remcos family

      remcos

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks