Overview

overview

10

Static

static

3

TODOSE.exe

windows7-x64

10

TODOSE.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    TODOSE.exe

  • Size

    548.0MB

  • Sample

    231114-ya6kgsfe64

  • MD5

    895f66700e7dbfe85e4863b651a54936

  • SHA1

    48d4bdc043a2dca396aeb9e807cc34610ac92e37

  • SHA256

    62e3f72bc0079451bb96d39b90668270febc34f50d2c4f2c5d4dbe4d69121d4a

  • SHA512

    b11ef0a6488d3aa719be13744e96dc9a3872a72ea3b21d6f19103ba10b6a90998a8e2af65877431c9ede154146cd3996f56dc2d0fb85058ad84a7a17a510d96c

  • SSDEEP

    12288:Ck7o5ERwPpv9plzKc4VVRxAXjrISCWMcaTNnaM8H41VQJ:Ck7o5HtTlnAVR0jrIJWOJnaMC41Vy

Score
10/10
remcoscampeonrat

Malware Config

Extracted

Family

remcos

Botnet

CAMPEON

C2

millon777.con-ip.com:7770

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-ECXMFE

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      TODOSE.exe

    • Size

      548.0MB

    • MD5

      895f66700e7dbfe85e4863b651a54936

    • SHA1

      48d4bdc043a2dca396aeb9e807cc34610ac92e37

    • SHA256

      62e3f72bc0079451bb96d39b90668270febc34f50d2c4f2c5d4dbe4d69121d4a

    • SHA512

      b11ef0a6488d3aa719be13744e96dc9a3872a72ea3b21d6f19103ba10b6a90998a8e2af65877431c9ede154146cd3996f56dc2d0fb85058ad84a7a17a510d96c

    • SSDEEP

      12288:Ck7o5ERwPpv9plzKc4VVRxAXjrISCWMcaTNnaM8H41VQJ:Ck7o5HtTlnAVR0jrIJWOJnaMC41Vy

    Score
    10/10
    remcoscampeonrat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks