Overview

overview

10

Static

static

3

8ff4e6a597...33.exe

windows7-x64

10

8ff4e6a597...33.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8ff4e6a59790f11138b89b4f5a946c00d6259f17b0bb88b2b808f8b0676e3433

  • Size

    2.4MB

  • Sample

    240513-lqe19ahg95

  • MD5

    6e409c732339d8d71f87666d591f9856

  • SHA1

    d9c0a478f02642fbbbc1c3739f765a754e7fad78

  • SHA256

    8ff4e6a59790f11138b89b4f5a946c00d6259f17b0bb88b2b808f8b0676e3433

  • SHA512

    7a16b1e81379a2ad666b6c4ef5ebf610c5d63a6eecdb7452ac98e83da50cca5cbd4395fb41a0dec7f94fb92f16da2d32de45d8eb11585aaa3739c155a5e5971d

  • SSDEEP

    49152:zlVv/kvowwe0hJzJiwK+zM5awNMaL2TQG9ivR6jfu4Wv+eys1n0qdT0luyKYA:L/g0hJzHzXvTQGfjfu5Ty006xy

Score
10/10
remcoszgratspacolombiapersistencerat

Malware Config

Extracted

Family

remcos

Botnet

spacolombia

C2

areaseguras.con-ip.com:2701

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    loggsd

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    Rmc12145501-WMWIXV

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      8ff4e6a59790f11138b89b4f5a946c00d6259f17b0bb88b2b808f8b0676e3433

    • Size

      2.4MB

    • MD5

      6e409c732339d8d71f87666d591f9856

    • SHA1

      d9c0a478f02642fbbbc1c3739f765a754e7fad78

    • SHA256

      8ff4e6a59790f11138b89b4f5a946c00d6259f17b0bb88b2b808f8b0676e3433

    • SHA512

      7a16b1e81379a2ad666b6c4ef5ebf610c5d63a6eecdb7452ac98e83da50cca5cbd4395fb41a0dec7f94fb92f16da2d32de45d8eb11585aaa3739c155a5e5971d

    • SSDEEP

      49152:zlVv/kvowwe0hJzJiwK+zM5awNMaL2TQG9ivR6jfu4Wv+eys1n0qdT0luyKYA:L/g0hJzHzXvTQGfjfu5Ty006xy

    Score
    10/10
    remcoszgratspacolombiapersistencerat

    • Detect ZGRat V1

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks