Overview

overview

10

Static

static

1

SOPORTE DE...39.exe

windows7-x64

10

SOPORTE DE...39.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SOPORTE DE TRANSACCION DE PAGO A CUENTA BANCARIA SOPORTE PDF - 57489357489574898439.rar

  • Size

    1.3MB

  • Sample

    230329-wwggdaba5y

  • MD5

    71364bb8c9523c3bb7e9bb33ace7e9d1

  • SHA1

    3a3c0dc3e2e5d38acada6812883d39ef2822f599

  • SHA256

    f7525d0fcafdb7d7090567a1aa7355f14a6523c91888c3dd02ab703b65c42f5d

  • SHA512

    2e5a545911d4891ea24efac87f9dfb2f02ccf11e82e67bf38ba479a063d435cf22ec543d0ee69da5b7a05b69565df10b84301e4a37a57d52823c4184007132ff

  • SSDEEP

    24576:2cH1iw3sWciDY0e+fF+umJLjeKuAwlJQxOmmMGan0a9GHfbuSLTlP1:2+3sWcssumMewbQxXmNi1If7Tld

Score
10/10
remcosremotehostrat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

127.0.0.1:8029

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-BCZU1N

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      SOPORTE DE TRANSACCION DE PAGO A CUENTA BANCARIA SOPORTE PDF - 57489357489574898439.exe

    • Size

      1023.9MB

    • MD5

      c283d82812b2e80846a879895d204f01

    • SHA1

      43c526cafa424f552e1f4fc94678003d98b636dd

    • SHA256

      49234c0c543aa6a86ebbec623e955c42bfc49de99d2c36cf44e9013b39b4a344

    • SHA512

      4ffac27ad2687747f92e10bc74067b6f4edab145e895db783346d3a8e0ef252b01726378b95c70a7094b441c2819fd1b79d966c7e7d2ddb884bbb9408e94989d

    • SSDEEP

      12288:1TDAkdNOLpvSNQpBHh6J0l14WRLxPl5kImpm4yMqxEj98Q:ZAkXORKKBHR4Wbl7NEJf

    Score
    10/10
    remcosremotehostrat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks