remcos

General

Target

TRANSACCIÓN FR DE VENTA No FE183454.eml
Size

21KB
Sample

241009-swhsnasdld
MD5

906df754f398cd8b2785799aede5457e
SHA1

37c19ca3319c88ea3d56c1f55c3285c0e9c16889
SHA256

d034dc322808e5197d59be36bb24713f59c5ff6d4a9f2e6ded124ec2caa9a8c8
SHA512

64752cb2c33ff461d8a4217ec44c55ab976188bfd09d927bf76f5b5b0e45653124169ce0953ca66545058be4b41db302fe4cc887024c7d561ea7d0e945eb1cc7
SSDEEP

384:hwq2q6sFTzPybUeCUCiCh5m5sju45d5mePp57CgbxrklL3J2Ges2ZTTCla:ehwzPz9nxTAsjuinVel43scTd

Score

10^/10

Malware Config

Extracted

Family

remcos

Botnet

Voltarger

C2

dfgdfghghfhfh.con-ip.com:1665

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-I3REIW
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Targets

- Target
  
  TRANSACCIÓN FR DE VENTA No FE183454.eml
- Size
  
  21KB
- MD5
  
  906df754f398cd8b2785799aede5457e
- SHA1
  
  37c19ca3319c88ea3d56c1f55c3285c0e9c16889
- SHA256
  
  d034dc322808e5197d59be36bb24713f59c5ff6d4a9f2e6ded124ec2caa9a8c8
- SHA512
  
  64752cb2c33ff461d8a4217ec44c55ab976188bfd09d927bf76f5b5b0e45653124169ce0953ca66545058be4b41db302fe4cc887024c7d561ea7d0e945eb1cc7
- SSDEEP
  
  384:hwq2q6sFTzPybUeCUCiCh5m5sju45d5mePp57CgbxrklL3J2Ges2ZTTCla:ehwzPz9nxTAsjuinVel43scTd
Score

10^/10

remcos voltarger discovery persistence rat
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  
  descarga (2).png
- Size
  
  4KB
- MD5
  
  d51cf0e80702dbf39710cebc08ba6228
- SHA1
  
  1b14a92b19e84cde1a49a6e47c7f2361be4baa46
- SHA256
  
  7e2cddf3efd6518a09033b703523d52602b575f756e8eea886d5958a1e9005a4
- SHA512
  
  7b4f4f520324429b38473f54db77a321ade3472204d2779db2d6c4ce83421e571df185073a60c5dc1b67d38b87be5816d0dd55d5720db346584a914b9874d228
- SSDEEP
  
  96:xLLGDaEidrYEA77b2YKwdkH+yeQfcB8rIrVKuRfySEw:xLLwidrtAVjE+NQfcVrVzEw
Score

3^/10
behavioral3 behavioral4
- Target
  
  email-html-2.txt
- Size
  
  6KB
- MD5
  
  7fd755737523f145ae1d1b40c551f5c4
- SHA1
  
  dfc4d77692039375ec7c9a50097ae8c3b5846be1
- SHA256
  
  f5ce58aa675123c619c9f2a949969e1ec830212d16cb688ddf1e03fdf8579292
- SHA512
  
  d4360dd519ccc86d0e0d91f887a93df1a9d21a16bf38e8d35d47b49cc6074ef8982cac729281cc97e550375ce7dd1fdc19c027578a094e44ac47a29196839016
- SSDEEP
  
  192:ri5cqHqBqjoQDoQk1LeRbioQaoQcQQfQh8osoQ2O:riWqHqBqj1D1ILeRW1a1cdOs12O
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  
  email-plain-1.txt
- Size
  
  1KB
- MD5
  
  d00f2c80ec385927ce9e3a34d03aacfa
- SHA1
  
  6543b2f12e5470325560c86b29839d19724a89ab
- SHA256
  
  26675c8632e03c0b867c279dd0eb6c7ee5bf727bad4263b31173a65582534078
- SHA512
  
  c7bc205c8bbf9db3b696e6fff6113d67cfcfaed362479cc71d73be230a1174c2c0b73052c709a105f5cb395a60d94248aa455279d9ecdb9cd2075ab70ddb0f7b
Score

1^/10
behavioral7 behavioral8