Derin Statik Analiz — Remcos | Tehdit: high
Archivo Kimliği
| SHA256 | 40079f05ba7cdccac1f62f8e7e1b644bc0a806b58465f5c005725bc54ee73ef1 |
|---|---|
| MD5 | 496caac1fa6369e93cb48970f72e26da |
| SHA1 | bd2a22a6bab8f5d5c146f6162ad28244ab22985b |
| Nombre de archivo | 07_remcos_agent_7.1.0.bin |
| Tamaño | 514188 byte |
| Tipo | /opt/ksentinel/samples/40079f05ba7cdcca_07_remcos_agent_7.1.0.bin: PE32 executable (GUI) Intel 80386 |
| Fecha de compilación | Desconocido |
| Packer | UPX |
C2 Sunucuları / Dropper Domainleri
| Adres | Tip | Durum |
|---|---|---|
BreakingSecurity.net | Domain | active |
pro.ip-api.com | Domain | active |
Tespit Edilen IOC'lar
| Valor | Tip |
|---|---|
BreakingSecurity.net | Domain |
pro.ip-api.com | Domain |
https://pro.ip-api.com/line/?key=QPVvv1rHQJD2pd2&field | URL |
\AppData\Local\Google\Chrome\User Data\Default\Cookies | Mutex |
\AppData\Local\Google\Chrome\User Data\Default\Login Data | Mutex |
Yetenekler
- Process Injection
- Process Hollowing
- Browser Credential Theft
- HTTP C2
- Anti-Debug
Şifreleme: -----BEGIN RSA PRIVATE KEY----- -----END RSA PRIVATE KEY-----
Geliştirici İpuçları
Telegram: @0D0H0L0P0T0X0 @0H0P0X0 @1H1P1X1 @2H2P2X2 @2L2V2b2l2x2
PE Analizi
PE Confianzalik Taraması
file entropy: 6.600577 (normal) fpu anti-disassembly: no imagebase: normal entrypoint: normal DOS stub: normal TLS directory: found - no functions timestamp: normal
Import Tablosu (özet)
Imported functions
Library
Name: KERNEL32.dll
Functions
Function
Hint: 323
Name: FindNextFileA
Function
Hint: 284
Name: ExpandEnvironmentStringsA
Familia Tespiti — String Kanıtı
Remcos Remcos Agent initialized ( Remcos restarted by watchdog! Remcos v
Remcos — Perfil del malware
RemcosRAT. SCAN DOC LOI.r00 multipart RAR. French LOI law lure. Five c2 substrings. Breaking-Security developer.
Tipo de malware
RAT
Lenguaje de programación
C++
Protocolo C2
TCP/SSL
Sistemas objetivo
Windows
También conocido como (AKA)
RemcosRAT
Capacidades y comportamiento
Uzaktan Erişim & Kontrol
Keylogger
Ekran Görüntüsü
Webcam Erişimi
Dosya Yönetimi
Süreç Yönetimi
Komut Yürütme
Kalıcılık Mekanizması
Lista IOC (12 indicadores)
IOC — Remcos
#
bd2a22a6bab8f5d5c146f6162ad28244ab22985b
# SHA256
40079f05ba7cdccac1f62f8e7e1b644bc0a806b58465f5c005725bc54ee73ef1
# MD5
496caac1fa6369e93cb48970f72e26da
# DOMAIN
BreakingSecurity.net
# DOMAIN
pro.ip-api.com
# MUTEX
\AppData\Local\Google\Chrome\User Data\Default\Cookies
# MUTEX
\AppData\Local\Google\Chrome\User Data\Default\Login Data
# FILEPATH
C:\Program File
# FILEPATH
C:\Window
# FILEPATH
T:\:d:l:t:
# FILEPATH
X:\:`:d:h:l:p:t:x:
# URL
https://pro.ip-api.com/line/?key=QPVvv1rHQJD2pd2&field
| Tipo | Valor | Nota |
|---|---|---|
| bd2a22a6bab8f5d5c146f6162ad28244ab22985b | ||
| sha256 | 40079f05ba7cdccac1f62f8e7e1b644bc0a806b58465f5c005725bc54ee73ef1 | |
| md5 | 496caac1fa6369e93cb48970f72e26da | |
| domain | BreakingSecurity.net | |
| domain | pro.ip-api.com | |
| mutex | \AppData\Local\Google\Chrome\User Data\Default\Cookies | |
| mutex | \AppData\Local\Google\Chrome\User Data\Default\Login Data | |
| filepath | C:\Program File | |
| filepath | C:\Window | |
| filepath | T:\:d:l:t: | |
| filepath | X:\:`:d:h:l:p:t:x: | |
| url | https://pro.ip-api.com/line/?key=QPVvv1rHQJD2pd2&field |
Servidores C2 (3 servidores registrados para esta familia)
| Dirección | Tipo | Puerto | Protocolo | Estado | País |
|---|---|---|---|---|---|
| BreakingSecurity.net | domain | — | HTTP | active | — |
| pro.ip-api.com | domain | — | HTTP | active | — |
| UNKNOWN_HOST | unknown | 20343 | TCP | inactive | — |
Las direcciones C2 se proporcionan únicamente a partir de muestras de malware verificadas manualmente por el equipo KEYDAL. Se prohíbe el uso comercial.