Overview

overview

10

Static

static

1

REGISTRO D...24.msg

windows7-x64

10

REGISTRO D...24.msg

windows10-2004-x64

3

Resubmissions

03-10-2024 06:29

241003-g9cysayhpk 10

03-10-2024 06:26

241003-g7l4nssgme 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    REGISTRO DEL SIGUIENTE MOVIMIENTO TRANSACCIONAL OCTUBRE 2 DE 2024.msg

  • Size

    124KB

  • Sample

    241003-g9cysayhpk

  • MD5

    c04019e5e21fc1cf061de5b0e8caa1c1

  • SHA1

    aa856e33162e2522f82211f9f71c98fe92319412

  • SHA256

    bf7d0c3a7e78753f47c0a03debef9d6ade31c1fdec1b438971aac507e68c3144

  • SHA512

    da3ce691514632a3102603f0803510b12688c0a1644419acc53166c645e81536efa391bb05f8cc75ca9729619ad38f51e6beeeee5cd5a36190813cef62946c38

  • SSDEEP

    1536:C9+FUeAN25Q1yAvfxtMDadI/WQWIW0dDnqvhxoiWGHle1:C9+uTNZtgaSNDngxDFe1

Score
10/10
remcosxioamortdiscoverypersistencerat

Malware Config

Extracted

Family

remcos

Botnet

XIOAMORT

C2

vcvfdjvodsuhvf.con-ip.com:1661

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-ALVZO2

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      REGISTRO DEL SIGUIENTE MOVIMIENTO TRANSACCIONAL OCTUBRE 2 DE 2024.msg

    • Size

      124KB

    • MD5

      c04019e5e21fc1cf061de5b0e8caa1c1

    • SHA1

      aa856e33162e2522f82211f9f71c98fe92319412

    • SHA256

      bf7d0c3a7e78753f47c0a03debef9d6ade31c1fdec1b438971aac507e68c3144

    • SHA512

      da3ce691514632a3102603f0803510b12688c0a1644419acc53166c645e81536efa391bb05f8cc75ca9729619ad38f51e6beeeee5cd5a36190813cef62946c38

    • SSDEEP

      1536:C9+FUeAN25Q1yAvfxtMDadI/WQWIW0dDnqvhxoiWGHle1:C9+uTNZtgaSNDngxDFe1

    Score
    10/10
    remcosxioamortdiscoverypersistencerat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks