remcos | 7efa4dff44ccd8ddcbf17ddce11837a80e21bc9c397cdcb1ccd2d4b86f74031e | Triage

Sharing

General

Target

7efa4dff44ccd8ddcbf17ddce11837a80e21bc9c397cdcb1ccd2d4b86f74031e
Size

463KB
Sample

220121-szev6saccm
MD5

ddfcdfe9ef9ffa7be1241e1772f1e6ae
SHA1

1f9612d80471c4fd11640a579158fe14bc520954
SHA256

7efa4dff44ccd8ddcbf17ddce11837a80e21bc9c397cdcb1ccd2d4b86f74031e
SHA512

023cf95d359053e613e144c077cdb9c837e81d4d0350e10c4fc4ed499db66e4403aac679d85c7901dae476ae800edef3c25c01eb40c9e49528d44ea3621a2ac5

Score

10^/10

remcos test rat

Malware Config

Extracted

Family

remcos

Version

3.3.2 Pro

Botnet

test

C2

dynasty1.ddns.net:2404

dynasty2.ddns.net:2404

dynasty3.ddns.net:2404

sumav1.hopto.org:2404

sumav2.hopto.org:2404

sumag.hopto.org:2404

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
bjdbhfjfnhfkhdoduifghfjdbdhfb-D7MYG9
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
wikipedia;solitaire;

Targets

- Target
  
  7efa4dff44ccd8ddcbf17ddce11837a80e21bc9c397cdcb1ccd2d4b86f74031e
- Size
  
  463KB
- MD5
  
  ddfcdfe9ef9ffa7be1241e1772f1e6ae
- SHA1
  
  1f9612d80471c4fd11640a579158fe14bc520954
- SHA256
  
  7efa4dff44ccd8ddcbf17ddce11837a80e21bc9c397cdcb1ccd2d4b86f74031e
- SHA512
  
  023cf95d359053e613e144c077cdb9c837e81d4d0350e10c4fc4ed499db66e4403aac679d85c7901dae476ae800edef3c25c01eb40c9e49528d44ea3621a2ac5
Score

10^/10

remcos rat
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
behavioral1

MITRE ATT&CK Matrix

Tasks

static1

behavioral1