General

  • Target

    CEC_Bon_de_plata.pdf.img

  • Size

    1.5MB

  • Sample

    240807-q4wy5ssfqa

  • MD5

    04afc712e09dea2782d491a07da5abad

  • SHA1

    72f16e8f3e7f9d491bf6c602b7dbddcc874a0094

  • SHA256

    7ee6d74121c2d7d2c21542308bcb91afe949bde5b31cfff8c7d504f3fa24ee94

  • SHA512

    6b6d7dcdebad8983ff482a71ff4e3771778f2e6374c975dffc90a9961e4fc82084bc3aee2fe04532f02b1ee6707346110d8ad57b320633be98a44f9218d2ab06

  • SSDEEP

    24576:cB/7/pYTVfsv208sSNW4ztXHldRBinBOiG:A/7OMbIWmnd2BOiG

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

212.162.149.42:7118

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-WYBPPO

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      CEC_Bon_de_plata.pdf.bat

    • Size

      969KB

    • MD5

      24781308181f7f22425faaac77451a3d

    • SHA1

      c62bcf469e55bde9c964ce613d6941867304c597

    • SHA256

      cb810150b6ce80f61a808726d5abfbf598239c2e8f260f83bc27d6be9488f45e

    • SHA512

      887b1e416b9ddcef846dda4b6aef7978b98d96c18f96a0f2e0c6660cc0e40c852396e588ebe908a914d37b010751bbbe42db6d0e64f5d249e6f108080fbed498

    • SSDEEP

      24576:OB/7/pYTVfsv208sSNW4ztXHldRBinBOiGJ:G/7OMbIWmnd2BOiGJ

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks