Overview

overview

10

Static

static

3

c413b5fc35...08.exe

windows7-x64

6

c413b5fc35...08.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c413b5fc353f566a47c17c56b69b2cc7b33e048673b78678d33b3aa8804d1d08

  • Size

    2.6MB

  • Sample

    241114-ypp62ssejg

  • MD5

    8e921737fd53f5a40e982495f0c7c3c9

  • SHA1

    c46e2cae95d387f64964fa000b8daff2f646bdbb

  • SHA256

    c413b5fc353f566a47c17c56b69b2cc7b33e048673b78678d33b3aa8804d1d08

  • SHA512

    e767b00c4ea757b4af8dd0339260f5748d2475d5b94c6c2a83d20077990379068e8bf7bbfb7b2cf1015ad4f56968456131447ab63225975d2bb5cdb2535f0fdc

  • SSDEEP

    49152:rTOYjy2jq6ZutrfM2IAIbu/GFcThB84muqmSj9TgM/rhiYO/CeQTWoNdjjEPOaDT:rBIknAIbuQ2mtnhiY8dT

Score
10/10
remcosrojodiscoverypersistencerat

Malware Config

Extracted

Family

remcos

Botnet

ROJO

C2

nuevodntestchec.addns.org:3018

Attributes
  • audio_folder

    MicRecords

  • audio_path

    ApplicationPath

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    registros.dat

  • keylog_flag

    false

  • keylog_folder

    data

  • mouse_option

    false

  • mutex

    jjajbsfbisfablklsafg-LEIC4X

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Capturas de pantalla

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      c413b5fc353f566a47c17c56b69b2cc7b33e048673b78678d33b3aa8804d1d08

    • Size

      2.6MB

    • MD5

      8e921737fd53f5a40e982495f0c7c3c9

    • SHA1

      c46e2cae95d387f64964fa000b8daff2f646bdbb

    • SHA256

      c413b5fc353f566a47c17c56b69b2cc7b33e048673b78678d33b3aa8804d1d08

    • SHA512

      e767b00c4ea757b4af8dd0339260f5748d2475d5b94c6c2a83d20077990379068e8bf7bbfb7b2cf1015ad4f56968456131447ab63225975d2bb5cdb2535f0fdc

    • SSDEEP

      49152:rTOYjy2jq6ZutrfM2IAIbu/GFcThB84muqmSj9TgM/rhiYO/CeQTWoNdjjEPOaDT:rBIknAIbuQ2mtnhiY8dT

    Score
    10/10
    discoverypersistenceremcosrojorat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Remcos family

      remcos

    • Downloads MZ/PE file

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks