General
-
Target
OTOTjU.rar
-
Size
1020KB
-
Sample
240720-shseya1gmr
-
MD5
99ab443e1486b9ba41ea6debc9fa0481
-
SHA1
992608f5e80f59180e12350347101026001e426f
-
SHA256
48f21c28de9fa584e101c2bce41bbe66740530d053a82fa5dd52146696613313
-
SHA512
0bd87a262982aeaec695df1dd87b76847362270d85bdacc4738308f7eeaa5485c362a877f9de232dbb88418b194d61929653f50d8732590bbf9b869dc451721d
-
SSDEEP
24576:reiqwWs8eCbNe6cEhdREbmB5aTNs/2w0Ok:qiqM80AREbmB5Qau5
Static task
static1
Behavioral task
behavioral1
Sample
OTOTjU.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
OTOTjU.exe
Resource
win10v2004-20240709-en
Malware Config
Extracted
remcos
JUNIO2024
hotsdefender.webredirect.org:2404
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
true
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
Key
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
JuNi0qE6LM1GNs0exSufE75UDJg-V052U8
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
wikipedia;solitaire;
Targets
-
-
Target
OTOTjU.exe
-
Size
909.1MB
-
MD5
a51521ef9993fb6a289a23d761fb2174
-
SHA1
65cbfdfb34cbec57e1a184017976f0a4439b3c9c
-
SHA256
6d295d4c0de4ae3c8bbde1f41fd77f1d7b8a9a7c0e36bd9a3c59e317d5a61f3f
-
SHA512
4a1a8ee7bb0e8b9646350f3a311a7e6efbc245eccd0a3d0b7f2550edff38736a2468b254ecaf0d6d19fe0cb805bc7539dc7bce7690a98ea33ca918f56f8254bc
-
SSDEEP
49152:AkJwqMHkkbXS2eb1YW5256cyWtaPpYIWdfLvD:bdMEkVm1l5256cyWtaPp0dn
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1