General
-
Target
1d0c839f62d4bba569a80e880014eb6a8613ffc954c86e52a3312ea2ddd65813
-
Size
1.4MB
-
Sample
241021-x3scwssapa
-
MD5
8cf11afafd91e4d7ac6eea72b019dfed
-
SHA1
3a15556aa6e658fe1c29261de233b294d7c80203
-
SHA256
1d0c839f62d4bba569a80e880014eb6a8613ffc954c86e52a3312ea2ddd65813
-
SHA512
59f630f0ec55eeb302ab26ac49c31a036b8152b3cbcb8ad358d7ed0a2af945a1aae81203e2b63eea7e79d1f6b2c2503adad2c31cc369a85a99e26c848f9fd725
-
SSDEEP
24576:Ae/k8isyqMN0BUw9MxP8wtBMLB0bSRP/UsZgUX8c/dbgLtdZp/VllpZhCIkA5l/t:Ap8irS19WPtBucSxcEtdkLtdpllpGnxk
Malware Config
Extracted
remcos
rosas
pruebaoctubrenuevo.ydns.eu:3018
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
registros.dat
-
keylog_flag
false
-
keylog_folder
datos
-
mouse_option
false
-
mutex
mkfhndhytdhjualcyyrfw-1E1OP0
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Capturas de pantalla
-
screenshot_path
%AppData%
-
screenshot_time
10
- startup_value
-
take_screenshot_option
false
-
take_screenshot_time
5
Extracted
remcos
ZONIDO
intelcom.ydns.eu:1831
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
nsdnnfndjfd-M797LK
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
- startup_value
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
-
Target
Portaflio Prioritario - Informe de Robo 21 de Octubre/Consolidado Prioritario - Informe de Robo 21 de Octubre.exe
-
Size
130KB
-
MD5
5af3ce90fc3fa5c03a2e45b20667c285
-
SHA1
4a4926267eda634af0c47b2b1e1c53bb159d0ea0
-
SHA256
9f804739f1168e139d5cbc1a66dc2c3f858d626274d5c0e25b60c9547782b5e9
-
SHA512
34ceeef28316fbbb228f63ac63044de5c154ab694189063ce961260327ab9c8701be9622356aa1eca275062ff11b74a20997418a6231b406c935543a0ebf9e05
-
SSDEEP
1536:0hZKhinXt1nnXdIKREzLsY9bBFDEqrfURuwncv+xk89sY7VCpEqBOQ9Xmf0Zh+E+:ywyvdIKREzLdnG8Eh8Xmf0ZgvbR
Score10/10-
Remcos
Remcos is a closed-source remote control and surveillance software.
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Drops startup file
-
Suspicious use of SetThreadContext
-
-
-
Target
Portaflio Prioritario - Informe de Robo 21 de Octubre/Doc 030435993940034 - Informe de Robo 21 de Octubre.exe
-
Size
2.8MB
-
MD5
d8c548207ef7aaaeae2d83dc53ea84fc
-
SHA1
1b785c08d48a8ad9c70fc30411759ab730d77512
-
SHA256
13754433d3ede403430e4eafdc1a45567639716e9ee8763bf3a6b391ae07ada7
-
SHA512
7d934aa40716329e9cc09574cf56913819b6b3d316dde4cae536856378722940b033b61973d33d5bd23da9ff337f70ca5a704ebea56fe114aec9bde7fb6a1ed7
-
SSDEEP
49152:7nP6JoJ67eQD9rSl5thuDZzjz4YVwNehjzEWZ84+dFTN1SmxANwJMigXAJ:bqnQudzjz4Y1hXEWG4QMrAJ
Score10/10-
Remcos
Remcos is a closed-source remote control and surveillance software.
-
Adds Run key to start application
-