Overview

overview

10

Static

static

1

25c2386fe9...c1.exe

windows7-x64

10

25c2386fe9...c1.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    25c2386fe9a66c179152b8c97e006d8d213c2923afeb897b7a60ecc9e0f28ec1

  • Size

    1.5MB

  • Sample

    240905-zbl3xayenq

  • MD5

    faf49e0af5229a853c23b649724aeef4

  • SHA1

    56164915b4528cd3902e11fb379023e1098767b6

  • SHA256

    25c2386fe9a66c179152b8c97e006d8d213c2923afeb897b7a60ecc9e0f28ec1

  • SHA512

    bfb41c8092f3ad71e3a7cbce0747c70dbecb3474d5458cf464f387728a238993441ddc21342c7f5be2a2428fbf72d26bf5b4d1a0389a587138c9ed1cd30fdc0c

  • SSDEEP

    49152:Xdw4s5atF5YeEpoK6rskkc3OEcZwQP39Z:X+4tHYeEySdE4xPH

Score
10/10
remcostottefandiscoverypersistencerat

Malware Config

Extracted

Family

remcos

Botnet

TOTTEFAN

C2

ijdfidjsbfjisbdfv.con-ip.com:1667

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-4BKKLL

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      25c2386fe9a66c179152b8c97e006d8d213c2923afeb897b7a60ecc9e0f28ec1

    • Size

      1.5MB

    • MD5

      faf49e0af5229a853c23b649724aeef4

    • SHA1

      56164915b4528cd3902e11fb379023e1098767b6

    • SHA256

      25c2386fe9a66c179152b8c97e006d8d213c2923afeb897b7a60ecc9e0f28ec1

    • SHA512

      bfb41c8092f3ad71e3a7cbce0747c70dbecb3474d5458cf464f387728a238993441ddc21342c7f5be2a2428fbf72d26bf5b4d1a0389a587138c9ed1cd30fdc0c

    • SSDEEP

      49152:Xdw4s5atF5YeEpoK6rskkc3OEcZwQP39Z:X+4tHYeEySdE4xPH

    Score
    10/10
    remcostottefandiscoverypersistencerat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks