Overview

overview

10

Static

static

3

AE09579G00...VC.exe

windows7-x64

10

AE09579G00...VC.exe

windows10-2004-x64

10

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    94d0aa368cdbd0b4f5aced46f8f1c368e3c64132b3246b6e575b1fc47ae28d34.xz

  • Size

    596KB

  • Sample

    250218-dt7axawphv

  • MD5

    d9229dcfff68fc36d1a796dd4b23fe83

  • SHA1

    2271ea60791cc2aa1c02fa8814ed860205925c6f

  • SHA256

    94d0aa368cdbd0b4f5aced46f8f1c368e3c64132b3246b6e575b1fc47ae28d34

  • SHA512

    85374571037d03e5a0837a0eb0d906b277d3c1a724ccea4b032aebaa010d3c6aeef473ffef5d258af5a68a82ba731ebc76dc9686292befd14b58517b8099493a

  • SSDEEP

    12288:nLc4Cb3XhsGGnmJoUkS5YNsrN4ueRAfufMlqxFm5a+cYtX:oJ3Xcmd+6N4RRAfuf1nmnX

Score
10/10
guloaderremcosremotehostcollectiondiscoverydownloaderpersistenceratspywarestealer

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

198.135.51.176:49950

Attributes
  • audio_folder

    MicRecords

  • audio_path

    ApplicationPath

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-ALVH88

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      AE09579G0033855AEDXBFFHHHHJ-VC.exe

    • Size

      725KB

    • MD5

      6a8043f977b84ab39909b260cbad90d3

    • SHA1

      a635e93bc25b3c5138bef52ac9f163638f9c015d

    • SHA256

      38321cf0a7c19a1f0a143631332b06bc6dad5b753416b50a7d3328cfa3d14224

    • SHA512

      3f88ad7f79a927ada664daefa6e7413ca3910a5cf9584bd961759e1f1cbc07380f318b1e6d2f70b9332a96eda25e532b046bd75c96ae9843a5297c6ac8e4e6a4

    • SSDEEP

      12288:fJIbMYmn5o9n8yNAj0Vg+r9dCOSHDBfYTMNKH1HzFJs:fJYmg9NAgVxr9dCOSHdt6jO

    Score
    10/10
    guloaderremcosremotehostdiscoverydownloaderpersistenceratcollectionspywarestealer

    • Guloader family

      guloader

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Remcos family

      remcos

    • Detected Nirsoft tools

      Free utilities often used by attackers which can steal passwords, product keys, etc.

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook accounts

      collection

    • Adds Run key to start application

      persistence

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      a436db0c473a087eb61ff5c53c34ba27

    • SHA1

      65ea67e424e75f5065132b539c8b2eda88aa0506

    • SHA256

      75ed40311875312617d6711baed0be29fcaee71031ca27a8d308a72b15a51e49

    • SHA512

      908f46a855480af6eacb2fb64de0e60b1e04bbb10b23992e2cf38a4cbebdcd7d3928c4c022d7ad9f7479265a8f426b93eef580afec95570e654c360d62f5e08d

    • SSDEEP

      192:aVL7iZJX76BisO7+UZEw+Rl59pV8ghsVJ39dx8T:d7NsOpZsfLMJ39e

    Score
    3/10
    discovery
    behavioral3behavioral4

MITRE ATT&CK Enterprise v15

Tasks