Overview

overview

10

Static

static

1

0000000000...51.rar

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0000000000000212154548789889484119185531513321323215154664889744562245436884816184326414251.tar

  • Size

    1.6MB

  • Sample

    241008-zp8ttsvhqj

  • MD5

    6a1737d98917b44ed8516619ec2b00dd

  • SHA1

    1f2e71b431bc0d968e5fb04a3b243fced6205e62

  • SHA256

    27a48ee19bd16817e6b345db0497c3b1c7be49f6ddb1e6214af38a44b4a7e0e5

  • SHA512

    c64a4e77ec63538736706e85ec92cb4d40519ff5f286677bc235a5a04a59d51316cd3518dad2f6450c2c411270fb7f38ad495b9f09ecf93b973f80bd0b787f8f

  • SSDEEP

    49152:iQWng0Uqk1O4HPgzir3uV4Oiq8ZU9+rdnVP/Q:iJg1b1Opir3uVj8ZLlVP/Q

Score
10/10
remcosmalohdiscoverypersistencerat

Malware Config

Extracted

Family

remcos

Botnet

MALOH

C2

octubre8.con-ip.com:7771

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-CGYV12

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      0000000000000212154548789889484119185531513321323215154664889744562245436884816184326414251.tar

    • Size

      1.6MB

    • MD5

      6a1737d98917b44ed8516619ec2b00dd

    • SHA1

      1f2e71b431bc0d968e5fb04a3b243fced6205e62

    • SHA256

      27a48ee19bd16817e6b345db0497c3b1c7be49f6ddb1e6214af38a44b4a7e0e5

    • SHA512

      c64a4e77ec63538736706e85ec92cb4d40519ff5f286677bc235a5a04a59d51316cd3518dad2f6450c2c411270fb7f38ad495b9f09ecf93b973f80bd0b787f8f

    • SSDEEP

      49152:iQWng0Uqk1O4HPgzir3uV4Oiq8ZU9+rdnVP/Q:iJg1b1Opir3uVj8ZLlVP/Q

    Score
    10/10
    remcosmalohdiscoverypersistencerat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks