remcos | 3ece0349ff1491f40f197bb85a516753e7922fc9a72b6705f2da78e961f7dbed

General

Target
Amiantit_RFQ_Documents.zip
Size 3.2MB
Sample260720-mt58aahx5z
SHA256 3ece0349ff1491f40f197bb85a516753e7922fc9a72b6705f2da78e961f7dbed
MD5 607330487df1d91dbdc3c25ba86fece3
SHA1 e78a5f03973d9a4dcbf23999b9ffa897041a2053
SHA512 70cbd72a429444e11458ee30b8ada06839d1d0a6ed849fa8f595abd387b521c2e6fdda8e171e1ffb4b70cf46c5e9fe17e9d4b7190a41509895c441705edb653e
SSDEEP 98304:GJYJnORtD/Of3tvK3eNnUa8nBwOO5Ry0UH3Se4bSN:GJYJnGtDOf3ZK3e+0r5kNXSPc
TLSH
T12CF53386243CC358CB55C19E5F3B96708D1E90CE86CF899AAB0D72A6FADF419043C7E5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Amiantit_RFQ_Documents/BOQ.lnk
- Size 1KB
- SHA256 5fb44b1f830a3c21b2e12287d79a79d60f9dfd3ad33c5a94e946078548a10c1d
- MD5 af9953deeb925554d524f2f262efe9bf
- SHA1 c82850341b6ee6ff80544d791c7439aa50b948d1
- SHA512 2ccb891467f0de144c0801df4d4860c3ae558e93002fd80c0f2a2a688925e167d1646b132185ed9bc845fc1a2897bd68c7ad04871fa981dee41f1ad09c096dbd
- TLSH
  T1E73135015AFF4974F3F2AF71C7745208C526FDE91A06DB8E4460110E0850F088936B33
- MD5 SHA1 SHA512 TLSH
Score

7^/10

discovery execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2
- Target
  Amiantit_RFQ_Documents/DRAWINGS.JS
- Size 4.5MB
- SHA256 8959481382543edd72ccf80ebde2249ea0fc79c44a52a95fd1be6b19135174b3
- MD5 5e6d2b4e607032cdc9b18b97ab9ebfb6
- SHA1 e35e8d1e2647bc0096bfb4f4cba08445844869a9
- SHA512 d2435f88d5cbd8028e235d19bebae46ef67c3ab66713c4e3c796c16989dd21547737dd7c77183083d38fbd104b89f203932de8d56722e52d5c203ca1413c12c5
- SSDEEP 98304:Kep4h2VXOAaJWpPezjwop7HVvHX5Jm0MpaSMvTE9mk2DKU04xgys9w11XMjpaeOo:n6qgJWpej/tH9360PSMvo9l2DBZgys4G
- TLSH
  T12C269D449E279E431058C3FCD105EFEEC5BE910B3624CE497A4E4DB8982DF197A693A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection credential_access discovery execution remcos persistence rat spyware stealer suricata
- Family: Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Suricata alert: REMCOS RAT Malware Inbound C2 Communication
  Network activity triggered a Suricata alert
  suricata remcos
- Suricata alert: REMCOS RAT Malware Outbound C2 Communication
  Network activity triggered a Suricata alert
  suricata remcos
- Uses browser remote debugging
  Can be used control the browser and steal sensitive information such as credentials and session cookies.
  credential_access stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral3 behavioral4
- Target
  Amiantit_RFQ_Documents/SPECIFICATIONS/Amiantit_Request_For_Quotation_for_Ongoing_Project_with_El_Sewedy_Co_in_Rabigh_GV.exe
- Size 499KB
- SHA256 d447a06cba8d3dbe80e09d73dd64576836b258961ee0d3ba56cf26cea7962b49
- MD5 7675b38aabebc8427171447edd484b5b
- SHA1 145c72f8acdcd366869f955dffd000d3bc146b6e
- SHA512 bc9bddbee59f165742a3203f9e2ba9de409e66de6334cb352cded84cce3e1074dbd0ac17b29e58c8729906848b64d1486fb8c848ca15422127b2baeb4c5e5dbe
- SSDEEP 12288:HW7YOPcqPqvopYJNWGIbK8AJYlqWuSr7B/Uj:HW7RPcqPqvopYJYK8AyldpUj
- TLSH
  T176B43AC4BACB08F1E2A355B0C49BDB7F96349A050022D5BAFF5CBD59EC33746092725A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6