Overview

overview

10

Static

static

10

8c9ccb64d6...28.exe

windows7-x64

1

8c9ccb64d6...28.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8c9ccb64d62d5489eb7c3c8febf700292a696f69f4ee93bb1ad607531a93c028

  • Size

    2.0MB

  • Sample

    250330-yvebqsyjy4

  • MD5

    0b23b73c4a523c12688053a9577b9259

  • SHA1

    eef7d5c6d2a5dbeca8bdb53395dc6809e82f1386

  • SHA256

    8c9ccb64d62d5489eb7c3c8febf700292a696f69f4ee93bb1ad607531a93c028

  • SHA512

    5033eee21e0f7e2d410ec83b2b18bdd407aa38d7028b657887fb8a33419c29070ad1ec839f025b93f22d06529fd78fb1b48033f6463f6d6925aa233e170c3b36

  • SSDEEP

    24576:x0Zp+ViehBWY0ZXn5+uWaPeKF0tetZtWvcybaaj+LMd9WQ9YnDCJcTt+h7+:niIB90ZXn0uWIs+L2kXZ+h7+

Score
10/10
remcosremotehostdiscoverypersistencerat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

80.85.154.131:1122

Attributes
  • audio_folder

    MicRecords

  • audio_path

    ApplicationPath

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    bag.exe

  • copy_folder

    bag

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    true

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    Bag loger

  • mouse_option

    false

  • mutex

    Rmc-CE8V5B

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      8c9ccb64d62d5489eb7c3c8febf700292a696f69f4ee93bb1ad607531a93c028

    • Size

      2.0MB

    • MD5

      0b23b73c4a523c12688053a9577b9259

    • SHA1

      eef7d5c6d2a5dbeca8bdb53395dc6809e82f1386

    • SHA256

      8c9ccb64d62d5489eb7c3c8febf700292a696f69f4ee93bb1ad607531a93c028

    • SHA512

      5033eee21e0f7e2d410ec83b2b18bdd407aa38d7028b657887fb8a33419c29070ad1ec839f025b93f22d06529fd78fb1b48033f6463f6d6925aa233e170c3b36

    • SSDEEP

      24576:x0Zp+ViehBWY0ZXn5+uWaPeKF0tetZtWvcybaaj+LMd9WQ9YnDCJcTt+h7+:niIB90ZXn0uWIs+L2kXZ+h7+

    Score
    10/10
    remcosremotehostdiscoverypersistencerat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Remcos family

      remcos

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks