Overview

overview

10

Static

static

3

DOCUMENTO ...RO.exe

windows7-x64

10

DOCUMENTO ...RO.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    615aefa682fa5886044366e08d0aaed29107febf4c813e171fb3f318cb865b39.bin

  • Size

    1.4MB

  • Sample

    240313-zmr4asge3s

  • MD5

    d12a636f5bbe7fe265187da5b5d1b663

  • SHA1

    0b6e5f2a2f3a460fb3fcb85889f44c269f848bf6

  • SHA256

    615aefa682fa5886044366e08d0aaed29107febf4c813e171fb3f318cb865b39

  • SHA512

    d556f071a762374c501c80acff5ce95b5f8cb8470bbce841336134387be98ba75e583eb8c5e255d2ec1028804c3f9fed5f464376bc71b033c32eea77a8ed9778

  • SSDEEP

    24576:vKz8aqhA6OKrkxbKDoEHc+ZKx2YRq3Z4yZ/raKrDFOMLPXRQVgt/9X74uscZ28v6:vjaqAKrkYc+ZKx2Ys3Wy/fDFZXRQSt/4

Score
10/10
remcosbbbbbrat

Malware Config

Extracted

Family

remcos

Botnet

BBBBB

C2

ferfnekfkjerfjre.con-ip.com:1995

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-B468MF

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      DOCUMENTO OFICIAL DE CANCELACIÓN DE CONTRATO 21 DE FEBRERO.exe

    • Size

      1023.9MB

    • MD5

      5d4432554faa63538ab4362aa67c501d

    • SHA1

      bbb415010f500bca1ad3fc43443b6d66e98a8e9b

    • SHA256

      c91265f4bd15473473917248476f78481af72156df9a4043cb47849ca3d814e7

    • SHA512

      51f271ecb509e239420e8f9b9b8d123ed8402f35de9fcb20106ea8452d3c663903d7d6508c95a3cad9040aeaebb6b8cdfaaa2a559a9e0c5c81ed7de447bab649

    • SSDEEP

      24576:JXQbwrXE1tVP6XQDV9XnfJi7ma5Ff/Lglfedx:Wwr0tCQnJi7ma5FLglf

    Score
    10/10
    remcosbbbbbrat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks