remcos

General

Target

JuezdelCircuitoTercero3roPenaldeCundinamarca-ProcesoNo.2024-52100-63561-56165.uue
Size

3.6MB
Sample

241123-ybzhkasnft
MD5

f2210ec05171d6a8c65ab3316cd880d1
SHA1

b232298ca4c64af62d78fbf4eb2d79c05ce69ebf
SHA256

92a0301d72af33ef4638fcbf8bda6c6c657e135e03d5d769337009f3fa72d62a
SHA512

6580b121bc6ee7031ab8e7a76d84e52f9d7522fa329e8756455dde0028a42d85a774b86cd3da690bb335f83be030a91f2d91a10ea730da74c72b5ffcc473b5c5
SSDEEP

49152:ghV0QARZ+n0GN/M+NlYwZ4V0XxZ+MPXOMvlKOdQccgs9R5qpmHxuuJ2KK5h:DYjN/LKwEgSHOdzVC3uNX

Score

10^/10

Malware Config

Extracted

Family

remcos

Botnet

BLANCO

C2

camino9938.strangled.net:3018

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
registros.dat
keylog_flag
false
keylog_folder
data
mouse_option
false
mutex
nhfkkasivbijkewflivlikewf-LIQNJX
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Capturas de pantalla
screenshot_path
%AppData%
screenshot_time
10
startup_value
take_screenshot_option
false
take_screenshot_time
5

Targets

- Target
  
  En este sentido, se le hace un llamado de atención para que se presente ante el Juez del Circuito Tercero (3ro) Penal de Cundinamarca, a más tardar el 08 de noviembre de 2024..exe
- Size
  
  6.1MB
- MD5
  
  2cede2aef03d4436cac510971c604d10
- SHA1
  
  1454f28eaf7deb3b33bc9e4beed261f935c2451a
- SHA256
  
  ac93bb754026e02ece7eb0ac015605b6b7e9e6fa1526def22a4bb3e34569ec59
- SHA512
  
  808d06c5a7b78ff8ea90ecbb4bfa8f3e1bce0b697736b877860e805521668020af51a479547db7b88f5acb6d5fde43b1579b539ef705a9bfa7d9b7a1d32de91c
- SSDEEP
  
  196608:N8QTH4OwL4MBQqus0YkuwYMfiUB5NdBD8R3ZZOR:N80H4OwLZBPus0YkuwYMfiUB5NvD03Z6
Score

10^/10

remcos blanco discovery rat
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Remcos family
  remcos
behavioral1 behavioral2
- Target
  
  Por medio de la presente, se le comunica que, en virtud del proceso No. 2024-52100-63561-56165, ejecutado por el Juzgado Tercero (3ro) Penal de Cundinamarca Especializado en Aseguramiento Penal a las Víctimas, se ha iniciado una quere.exe
- Size
  
  1.9MB
- MD5
  
  43cf93e82fc08aafdc361cf9153872b7
- SHA1
  
  58930c5fa68f01f181537b2c46cf2377b5a18d9f
- SHA256
  
  31abb0d6a6347feee6047af8f383c94158ace6d5b980145a141e6866844dfa15
- SHA512
  
  2bf50126c9514b43676e8655342ec2e03f37bc9793d5b57fd8d0bb2adfb5c2078ef92deeef09f3c01a660382b58d37975068c7cfc077031babd4ab083cf7668c
- SSDEEP
  
  49152:zMrPR37prLGB86MGtUYwHnM7BHhJDVxxip/tusCfX+i1E3cPJsuVZm5EgKj/yIXp:ArPR37pOBEkwHnMFHhJ5GTu
Score

6^/10

discovery persistence
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral3 behavioral4