General

  • Target

    CEC_Bon_de_plata.pdf.rar

  • Size

    886KB

  • Sample

    240807-qzzt8szakn

  • MD5

    636742820541c06da19e77383195961f

  • SHA1

    bf37f916f04aabe152f67d6d03b1663d5dbf4a4c

  • SHA256

    63860907ae7e491dbfae51f384e3b028b79905625e71d2e46c775e6acf8561e8

  • SHA512

    bf5f6304da6890fb09e7f551e2cb407fa3f346f250258d191b43eda7340e7527eace6a203c9960e3538830a571606644eb3a4ff798a9d3fc1d331a5a7cd8702e

  • SSDEEP

    24576:ufHJ/H2XnlC416VqHiqNfYih5BETaVl6aMia:ip/HulCq/CqNVh0TaVl6aMB

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

212.162.149.42:7118

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-WYBPPO

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      CEC_Bon_de_plata.pdf.img

    • Size

      1.5MB

    • MD5

      04afc712e09dea2782d491a07da5abad

    • SHA1

      72f16e8f3e7f9d491bf6c602b7dbddcc874a0094

    • SHA256

      7ee6d74121c2d7d2c21542308bcb91afe949bde5b31cfff8c7d504f3fa24ee94

    • SHA512

      6b6d7dcdebad8983ff482a71ff4e3771778f2e6374c975dffc90a9961e4fc82084bc3aee2fe04532f02b1ee6707346110d8ad57b320633be98a44f9218d2ab06

    • SSDEEP

      24576:cB/7/pYTVfsv208sSNW4ztXHldRBinBOiG:A/7OMbIWmnd2BOiG

    Score
    3/10
    • Target

      CEC_Bon_de_plata.pdf.bat

    • Size

      969KB

    • MD5

      24781308181f7f22425faaac77451a3d

    • SHA1

      c62bcf469e55bde9c964ce613d6941867304c597

    • SHA256

      cb810150b6ce80f61a808726d5abfbf598239c2e8f260f83bc27d6be9488f45e

    • SHA512

      887b1e416b9ddcef846dda4b6aef7978b98d96c18f96a0f2e0c6660cc0e40c852396e588ebe908a914d37b010751bbbe42db6d0e64f5d249e6f108080fbed498

    • SSDEEP

      24576:OB/7/pYTVfsv208sSNW4ztXHldRBinBOiGJ:G/7OMbIWmnd2BOiGJ

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks