Statik Analiz — RemcosRAT | HOCH | CVSS: 7.5
Datei
SHA256 193863103749d8b2f536cef7bbac7e9691f96742962c5aea4e9f6604db0c4aa7MD5 f9158f928bff45d130cc27d4ae20aee8Datei 193863103749d8b2f536cef7bbac7e9691f96742962c5aea4e9f6604db0c4aa7.exe Größe 525,824 byte Typ PE32 executable for MS Windows 5.01 (GUI), Intel i386, 5 sections Stringler 1,717
Bölümler Ad Entropi .text6.64 .rdata5.77 .data3.07 .rsrc4.14 .reloc6.71
Import Tablosu KERNEL32.dllUSER32.dllGDI32.dllADVAPI32.dllSHELL32.dllole32.dllWINMM.dllWS2_32.dllurlmon.dllgdiplus.dllWININET.dllIOC SHA256 193863103749d8b2f536cef7bbac7e9691f96742962c5aea4e9f6604db0c4aa7MD5 f9158f928bff45d130cc27d4ae20aee8Domain breakingsecurity.netC2 breakingsecurity.net
RemcosRAT - BreakingSecurity.net tarafindan lisansli satilan uzaktan erisim araci. Mesbru pentesting araci olarak satilsa da kriminal aktörler tarafindan yaygin kullanilir. Process hollowing, keylogger, clipboard/audio/screenshot izleme, Chrome kimlik bilgisi hirsizligi, UAC bypass, TLS 1.3 sifreli C2.
Auch bekannt als (AKA)
Remcos, Breaking-Security
Technische Details
TCP port 2404 (varsayilan), RC4 veya XOR sifreleme, C++ ile gelistirilmis, PE injection, UAC bypass (CMSTPLUA), AMSI bypass, Anti-debug (GetTickCount/RDTSC), DGA destekli C2, Keylogger, Screenshot, Audio
Attribution / Bedrohungsakteur
Breaking Security firmasinin isvicre tabanli olmasi nedeniyle ilk gelistirme AB'de gerceklestirilmistir; ancak surekli dunya genelinde siber suclu topluluklari tarafindan kullanilmaktadir.
IOC-Liste
(1 Indikatoren)
# DOMAIN
breakingsecurity.net
Typ Wert Bemerkung
domain breakingsecurity.net
C2 domain
C2-Server
(8 erfasste Server für diese Familie)
Adresse
Typ
Port
Protokoll
Status
Land
breakingsecurity.net
domain —
TCP
active
—
breakingsecurity.net
domain —
TCP
active
—
breakingsecurity.net
domain —
TCP
active
—
paint.net
domain —
TCP
active
—
americanshippingline.com
domain —
TCP
active
—
purl.org
domain —
TCP
active
—
adobe.com
domain —
TCP
active
—
paint.net
domain —
TCP
active
—