Overview

overview

10

Static

static

COMISARIAD...08.exe

windows7-x64

10

COMISARIAD...08.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    COMISARIADEFAMILIAVIOLEI20220908 COMISARIADEFAMILIAVIOLEI20220908.exe

  • Size

    1.1MB

  • Sample

    220909-p9twascadk

  • MD5

    fdb4485b1c82c89448fa7f19d05123e8

  • SHA1

    f1a4d64edd4378da77b0c50341d45d8924d63013

  • SHA256

    cfe504016eacb61c8958384ba10bffdd3673749716ebf2996ef7a85f6582ccb3

  • SHA512

    67bebeca7702f62df82a93b879049e377f4d18db5470dd65542ff1879b1fc9171ec4bb9b6b3536309b80a56a7d9ebc3cc79863c8b5f15e7adfe788ac40f27212

  • SSDEEP

    12288:L+jrBxsnAukKM/xv3EFKoIOfjtFae7rF03ca9SR2:LCcnWKmWFKqKqBwB9SR

Score
10/10
remcosfernandorat

Malware Config

Extracted

Family

remcos

Version

2.7.0 Pro

Botnet

FERNANDO

C2

fernand.con-ip.com:2002

Attributes
  • audio_folder

    MicRecords

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • install_path

    %AppData%

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    Remcos-FXZ76X

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

  • take_screenshot_title

    wikipedia;solitaire;

Targets

    • Target

      COMISARIADEFAMILIAVIOLEI20220908 COMISARIADEFAMILIAVIOLEI20220908.exe

    • Size

      1.1MB

    • MD5

      fdb4485b1c82c89448fa7f19d05123e8

    • SHA1

      f1a4d64edd4378da77b0c50341d45d8924d63013

    • SHA256

      cfe504016eacb61c8958384ba10bffdd3673749716ebf2996ef7a85f6582ccb3

    • SHA512

      67bebeca7702f62df82a93b879049e377f4d18db5470dd65542ff1879b1fc9171ec4bb9b6b3536309b80a56a7d9ebc3cc79863c8b5f15e7adfe788ac40f27212

    • SSDEEP

      12288:L+jrBxsnAukKM/xv3EFKoIOfjtFae7rF03ca9SR2:LCcnWKmWFKqKqBwB9SR

    Score
    10/10
    remcosfernandorat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks