Overview

overview

10

Static

static

3

build2.exe

windows7-x64

10

build2.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    build2.exe

  • Size

    1.4MB

  • Sample

    241120-v38c1a1bnl

  • MD5

    35f21b7e89b981c7a83a2fa5c834d154

  • SHA1

    5eb4dd6d3e659360c48d1c34ba16d29244cfca1e

  • SHA256

    c06a6c292aecf86af2feaaa4c13a4ce305c04a37823daf76dda71e9e790507d3

  • SHA512

    ff034daf566d5675c05ae86441c96119df66183d005628cae1a002b361694b76bc9cacbfb243001d0cf37ad3b95c135945d7c4626ec12f382fac7e91cc6b9fae

  • SSDEEP

    24576:xmI7etHLvLEh0UzA2NfTNTrStsycFWO0EWqTMSay7ty8g9In1rY:/6tXEh0UzA2NfTNTrSts9W+WRRytg9Ia

Score
10/10
remcospantalladiscoverypersistencerat

Malware Config

Extracted

Family

remcos

Botnet

pantalla

C2

oportunidad-escolombiasegura.cfd:3020

Attributes
  • audio_folder

    MicRecords

  • audio_path

    ApplicationPath

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    registros.dat

  • keylog_flag

    false

  • keylog_folder

    registro

  • mouse_option

    false

  • mutex

    ljblwjdblhaqoiencvmz-UC819L

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Capturas de pantalla

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      build2.exe

    • Size

      1.4MB

    • MD5

      35f21b7e89b981c7a83a2fa5c834d154

    • SHA1

      5eb4dd6d3e659360c48d1c34ba16d29244cfca1e

    • SHA256

      c06a6c292aecf86af2feaaa4c13a4ce305c04a37823daf76dda71e9e790507d3

    • SHA512

      ff034daf566d5675c05ae86441c96119df66183d005628cae1a002b361694b76bc9cacbfb243001d0cf37ad3b95c135945d7c4626ec12f382fac7e91cc6b9fae

    • SSDEEP

      24576:xmI7etHLvLEh0UzA2NfTNTrStsycFWO0EWqTMSay7ty8g9In1rY:/6tXEh0UzA2NfTNTrSts9W+WRRytg9Ia

    Score
    10/10
    remcospantalladiscoverypersistencerat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Remcos family

      remcos

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.