General
- Target 25092026_1031_25092026_PO_09162026_WeChat_Attachment_Sample_Pictures_November_2026_PO_ (2).gz
- Size 911KB
- Sample260925-mknxmsdd75
- SHA256 2aa1f17f346b9fdcb9054585110a96b3d77d88f42594f7c2f056125b6b795eab
Score
10/10
Malware Config
Targets
-
- Target PO 09162026 [WeChat Attachment] Sample Pictures_November.2026 PO_doc011492011492202501161354020220906134202501161354020220906134.MSI
- Size 940KB
- SHA256 965f7b8327a64556173a1d6045d2e13044c96fb2f39e7481eb0852741eb724ab
Score10/10-
Family: Remcos
Remcos is a closed-source remote control and surveillance software.
-
Suricata alert: REMCOS RAT Malware Inbound C2 Communication
Network activity triggered a Suricata alert
-
Suricata alert: REMCOS RAT Malware Outbound C2 Communication
Network activity triggered a Suricata alert
-
Executes dropped EXE
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1