{"id":288,"date":"2019-03-12T10:50:57","date_gmt":"2019-03-12T10:50:57","guid":{"rendered":"https:\/\/www.unsafehex.com\/?p=288"},"modified":"2024-09-27T17:29:17","modified_gmt":"2024-09-27T17:29:17","slug":"remcos-lettin-it-all-hang-out","status":"publish","type":"post","link":"https:\/\/www.unsafehex.com\/index.php\/2019\/03\/12\/remcos-lettin-it-all-hang-out\/","title":{"rendered":"Remcos lettin&#8217; it all hang out"},"content":{"rendered":"\n<p>I don&#8217;t post (or even tweet) very much about the malware going through my sandbox; in most cases it has been blogged about by more than one person in way more depth than I could. The other day, however, one stood out in my feed for a few reasons &#8211;<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>it was the first time I&#8217;d had a Remcos sample<\/li><li>contrary to what <a href=\"https:\/\/www.fortinet.com\/blog\/threat-research\/new-remcos-rat-variant-is-spreading-by-exploiting-cve-2017-11882.html\">most<\/a> <a href=\"https:\/\/blog.talosintelligence.com\/2018\/08\/picking-apart-remcos.html\">blogs<\/a> I read about it said, its C2 traffic was in the clear<\/li><li>despite knowing that Emerging Threats had multiple signatures explicitly for Remcos, I didn&#8217;t see any of them fire<\/li><\/ul>\n\n\n\n<figure class=\"wp-block-image\"><img loading=\"lazy\" decoding=\"async\" width=\"559\" height=\"464\" src=\"https:\/\/www.unsafehex.com\/wp-content\/uploads\/2019\/03\/02-Traffic-hex.png\" alt=\"\" class=\"wp-image-295\" srcset=\"https:\/\/www.unsafehex.com\/wp-content\/uploads\/2019\/03\/02-Traffic-hex.png 559w, https:\/\/www.unsafehex.com\/wp-content\/uploads\/2019\/03\/02-Traffic-hex-300x249.png 300w\" sizes=\"(max-width: 559px) 100vw, 559px\" \/><figcaption>Remcos C2 traffic<\/figcaption><\/figure>\n\n\n\n<p>The content is exactly what one would expect &#8211; an array of values holding parameters of the infected host, separated by the string &#8220;|cmd|&#8221;, but no decryption was necessary.<\/p>\n\n\n\n<p>Someone familiar with Remcos might also have spotted another odd feature from the above screenshot; the value &#8220;10.8.0.58&#8221; is the address of its C2 server. Given that my sandbox doesn&#8217;t have any route to a device with that address, these connections inevitably failed.<\/p>\n\n\n\n<p>What is the point of having a private IP as a C2 server? Two possibilities spring to mind: <\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>The sample was intended for a target network with an established foothold serving as an internal C2<\/li><li>It is an unfinished or test sample and the address is for the creator&#8217;s lab C2 server<\/li><\/ul>\n\n\n\n<p>I lean strongly toward the latter, given who it was sent to and that the data was also unencrypted, though I&#8217;m open to other ideas. <\/p>\n\n\n\n<p>SHA256: <\/p>\n\n\n\n<p>65f79343dea4024d439ef00d9effa663c76e2d683d49a7327f64aef673efb9d3 <\/p>\n\n\n\n<p><\/p>\n","protected":false},"excerpt":{"rendered":"<p>I don&#8217;t post (or even tweet) very much about the malware going through my sandbox; in most cases it has been blogged about by more than one person in way more depth than I could. The other day, however, one stood out in my feed for a few reasons &#8211; it was the first time [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-288","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v21.3 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Remcos lettin&#039; it all hang out &#8211; unsafehex<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.unsafehex.com\/index.php\/2019\/03\/12\/remcos-lettin-it-all-hang-out\/\" \/>\n<meta property=\"og:locale\" content=\"en_GB\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Remcos lettin&#039; it all hang out &#8211; unsafehex\" \/>\n<meta property=\"og:description\" content=\"I don&#8217;t post (or even tweet) very much about the malware going through my sandbox; in most cases it has been blogged about by more than one person in way more depth than I could. The other day, however, one stood out in my feed for a few reasons &#8211; it was the first time [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.unsafehex.com\/index.php\/2019\/03\/12\/remcos-lettin-it-all-hang-out\/\" \/>\n<meta property=\"og:site_name\" content=\"unsafehex\" \/>\n<meta property=\"article:published_time\" content=\"2019-03-12T10:50:57+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2024-09-27T17:29:17+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.unsafehex.com\/wp-content\/uploads\/2019\/03\/02-Traffic-hex.png\" \/>\n<meta name=\"author\" content=\"http_error_418\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@http_error_418\" \/>\n<meta name=\"twitter:site\" content=\"@http_error_418\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"http_error_418\" \/>\n\t<meta name=\"twitter:label2\" content=\"Estimated reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"1 minute\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.unsafehex.com\/index.php\/2019\/03\/12\/remcos-lettin-it-all-hang-out\/\",\"url\":\"https:\/\/www.unsafehex.com\/index.php\/2019\/03\/12\/remcos-lettin-it-all-hang-out\/\",\"name\":\"Remcos lettin' it all hang out &#8211; unsafehex\",\"isPartOf\":{\"@id\":\"https:\/\/www.unsafehex.com\/#website\"},\"datePublished\":\"2019-03-12T10:50:57+00:00\",\"dateModified\":\"2024-09-27T17:29:17+00:00\",\"author\":{\"@id\":\"https:\/\/www.unsafehex.com\/#\/schema\/person\/69a7fc817171b5a3c4770875a1918652\"},\"breadcrumb\":{\"@id\":\"https:\/\/www.unsafehex.com\/index.php\/2019\/03\/12\/remcos-lettin-it-all-hang-out\/#breadcrumb\"},\"inLanguage\":\"en-GB\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.unsafehex.com\/index.php\/2019\/03\/12\/remcos-lettin-it-all-hang-out\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.unsafehex.com\/index.php\/2019\/03\/12\/remcos-lettin-it-all-hang-out\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.unsafehex.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Remcos lettin&#8217; it all hang out\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.unsafehex.com\/#website\",\"url\":\"https:\/\/www.unsafehex.com\/\",\"name\":\"unsafehex\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.unsafehex.com\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-GB\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.unsafehex.com\/#\/schema\/person\/69a7fc817171b5a3c4770875a1918652\",\"name\":\"http_error_418\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\/\/www.unsafehex.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/fe9a4cdd9d9f058529884ce588767baf?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/fe9a4cdd9d9f058529884ce588767baf?s=96&d=mm&r=g\",\"caption\":\"http_error_418\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Remcos lettin' it all hang out &#8211; unsafehex","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.unsafehex.com\/index.php\/2019\/03\/12\/remcos-lettin-it-all-hang-out\/","og_locale":"en_GB","og_type":"article","og_title":"Remcos lettin' it all hang out &#8211; unsafehex","og_description":"I don&#8217;t post (or even tweet) very much about the malware going through my sandbox; in most cases it has been blogged about by more than one person in way more depth than I could. The other day, however, one stood out in my feed for a few reasons &#8211; it was the first time [&hellip;]","og_url":"https:\/\/www.unsafehex.com\/index.php\/2019\/03\/12\/remcos-lettin-it-all-hang-out\/","og_site_name":"unsafehex","article_published_time":"2019-03-12T10:50:57+00:00","article_modified_time":"2024-09-27T17:29:17+00:00","og_image":[{"url":"https:\/\/www.unsafehex.com\/wp-content\/uploads\/2019\/03\/02-Traffic-hex.png"}],"author":"http_error_418","twitter_card":"summary_large_image","twitter_creator":"@http_error_418","twitter_site":"@http_error_418","twitter_misc":{"Written by":"http_error_418","Estimated reading time":"1 minute"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.unsafehex.com\/index.php\/2019\/03\/12\/remcos-lettin-it-all-hang-out\/","url":"https:\/\/www.unsafehex.com\/index.php\/2019\/03\/12\/remcos-lettin-it-all-hang-out\/","name":"Remcos lettin' it all hang out &#8211; unsafehex","isPartOf":{"@id":"https:\/\/www.unsafehex.com\/#website"},"datePublished":"2019-03-12T10:50:57+00:00","dateModified":"2024-09-27T17:29:17+00:00","author":{"@id":"https:\/\/www.unsafehex.com\/#\/schema\/person\/69a7fc817171b5a3c4770875a1918652"},"breadcrumb":{"@id":"https:\/\/www.unsafehex.com\/index.php\/2019\/03\/12\/remcos-lettin-it-all-hang-out\/#breadcrumb"},"inLanguage":"en-GB","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.unsafehex.com\/index.php\/2019\/03\/12\/remcos-lettin-it-all-hang-out\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.unsafehex.com\/index.php\/2019\/03\/12\/remcos-lettin-it-all-hang-out\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.unsafehex.com\/"},{"@type":"ListItem","position":2,"name":"Remcos lettin&#8217; it all hang out"}]},{"@type":"WebSite","@id":"https:\/\/www.unsafehex.com\/#website","url":"https:\/\/www.unsafehex.com\/","name":"unsafehex","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.unsafehex.com\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-GB"},{"@type":"Person","@id":"https:\/\/www.unsafehex.com\/#\/schema\/person\/69a7fc817171b5a3c4770875a1918652","name":"http_error_418","image":{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/www.unsafehex.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/fe9a4cdd9d9f058529884ce588767baf?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/fe9a4cdd9d9f058529884ce588767baf?s=96&d=mm&r=g","caption":"http_error_418"}}]}},"_links":{"self":[{"href":"https:\/\/www.unsafehex.com\/index.php\/wp-json\/wp\/v2\/posts\/288"}],"collection":[{"href":"https:\/\/www.unsafehex.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.unsafehex.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.unsafehex.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.unsafehex.com\/index.php\/wp-json\/wp\/v2\/comments?post=288"}],"version-history":[{"count":1,"href":"https:\/\/www.unsafehex.com\/index.php\/wp-json\/wp\/v2\/posts\/288\/revisions"}],"predecessor-version":[{"id":296,"href":"https:\/\/www.unsafehex.com\/index.php\/wp-json\/wp\/v2\/posts\/288\/revisions\/296"}],"wp:attachment":[{"href":"https:\/\/www.unsafehex.com\/index.php\/wp-json\/wp\/v2\/media?parent=288"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.unsafehex.com\/index.php\/wp-json\/wp\/v2\/categories?post=288"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.unsafehex.com\/index.php\/wp-json\/wp\/v2\/tags?post=288"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}