Overview

overview

10

Static

static

3

remcos.exe

windows10-2004-x64

10

remcos.exe

windows11-ltsc_2024-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target
    remcos.exe
  • Size 855KB
  • Sample260709-vn2xnset3n
  • SHA256 e87a74c914a6fda1b92490e7b3d281a37d6b055dd6bf0f1d66f64352c9c41294
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
lxbaseratbindedporscheb137c284779d42a5bad56117ae1dcd02executionpersistencerat

Malware Config

Extracted

Family

  • lxbaserat

Version

  • 1.0.16

Botnet

  • BindedPorsche

Campaign

  • b137c284779d42a5bad56117ae1dcd02

C2

  • 45.149.145.19:4521

Attributes
  • directory

    Logs

  • executable

    client.exe

  • password

    o3NqidWkz8UaTMeKnnvX

Targets

    • Target
      remcos.exe
    • Size 855KB
    • SHA256 e87a74c914a6fda1b92490e7b3d281a37d6b055dd6bf0f1d66f64352c9c41294
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    bindedporscheb137c284779d42a5bad56117ae1dcd02executionlxbaseratpersistencerat

    • Family: LxBaseRAT

      LxBaseRAT is a .NET remote access trojan with stealer capabilities.

      ratlxbaserat

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks