Overview

overview

10

Static

static

3

FALLO ACCI...ES.exe

windows7-x64

10

FALLO ACCI...ES.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cca4f0044127edbf57fa73ba3a88380c.zip

  • Size

    3.7MB

  • Sample

    241023-tkesas1bqk

  • MD5

    cca4f0044127edbf57fa73ba3a88380c

  • SHA1

    03c55e7e6eee5561245fcf5ddb5844a5c16c7251

  • SHA256

    73030d097eee7a6491f3fd23a2515595b1abb18049d6d6d19b3e50387832b734

  • SHA512

    322bc55785d92e774de56f6805e688262761071ce99b849ff0d185bf05fe57a37edc4293c1470a14317a354a1acc29d0de6897d3631c0201d91f381aeeaf47c4

  • SSDEEP

    98304:2Akh1OXhNWzuIo7BJzrTzVTm7PxSwUnV9BElzu:X8mN65CBV9q7/UnV9BCS

Score
10/10
remcosamropazdiscoverypersistencerat

Malware Config

Extracted

Family

remcos

Botnet

AMROPAZ

C2

efwfw.loseyourip.com:1991

Attributes
  • audio_folder

    MicRecords

  • audio_path

    ApplicationPath

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-CCBODR

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      FALLO ACCIÓN DE TUTELA 2023-250 JDO 02 CMES.exe

    • Size

      10.1MB

    • MD5

      ae1f80b999450d4db03b32b5783e8026

    • SHA1

      5884d0c987dc8014cab52a058f5ba6706c29efb8

    • SHA256

      9a0a16a7058877e4914a6636b444f4f6e28673d04c732d9818ec16ff0a8a5427

    • SHA512

      183c3be851e6b649d22c845b716562e07b9c49de114b4dd913b4f54df7c6646ae2155d8035e7c721ab932c61707096c2ae19abb1c65cf774555632d63f106839

    • SSDEEP

      196608:8Wbk1lXrMI8h9rGe20fcAE9kspvCJ6UkXzp91IcA91IG91I1Mffx1usIF64:82OiI8h8EM91Ih91IG91I1Mff3usIFv

    Score
    10/10
    remcosamropazdiscoverypersistencerat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks