RemoteControlMalware
- remotecontrolclient
Last reported 2 years ago, by Huntress2 reports
ATT&CK techniques
6 of 10 · each with the sentence it comes from- T1059.003Windows Command Shell
“Execution - T1059.001 PowerShell, T1059.003 Windows Command Shell”
- T1003.001LSASS Memory
“Credential Access (Possible) - T1003.001 LSASS Memory”
- T1048.003Exfiltration Over Unencrypted Non-C2 Protocol
“Data Exfiltration - T1048.003 Exfiltration over Unencrypted Non-C2 Protocol”
- T1059.001PowerShell
“Execution - T1059.001 PowerShell, T1059.003 Windows Command Shell”
- T1078Valid Accounts
“Persistence - T1078 Valid Accounts”
- T1105Ingress Tool Transfer
“File Download - T1105 Ingress Tool Transfer”
What the reports say
2 reports, newest first · the exact sentence from each-
Ransomware Deployment Attempts Via TeamViewer“WIN-8GPEJ3VGB8U 21-12-2023 16:22:15 21-12-2023 16:29:51 user RemoteControl {GUID}”
-
Curling for Data: A Dive into a Threat Actor's Malicious TTPs“Support 01-12-2023 08:24:10 01-12-2023 08:24:28 <unknown> RemoteControl {<GUID>}”
Indicators in its reports
named in the reports above- 60ab8cec19fb2d1a…26c7768fd362in 1 report
- hxxp://193.149.176[.]90/Dokan_x64.msi.zipin 1 report
- 193.149.176[.]90in 1 report
- hxxp://193.149.176[.]90/MemProcFS.zipin 1 report
- hxxp://193.149.176[.]90/out.zipin 1 report
Copy these 5 indicators · defanged
Thanks — we review every report.