remcos

General

Target

12122024_0035_DEMANDA LABORAL POR ABUSO DE CONFIANZA 1516947.XZ
Size

4.7MB
Sample

241212-axgymstqct
MD5

02fe8c4d7a9aab9a0c178da177b638c4
SHA1

33ead85866b88ee3e7ac3ca0d22161c074504733
SHA256

a48166bf8e52ff3211dc6a750bd6646d00f591e4b1beaee4f09b54ac45a5efd2
SHA512

5a3cb89811d7c25928ec7f3f767819d1cf84047ad40657312ec9e7a6451b1f21e2a9da8e583aa382e6222289d5d7ddef098ff8543befe889ffdb287ea21516c1
SSDEEP

98304:7KwwncDi0TmPvF4y34gHAfw7u0rFgzNDpYQctqvNWdKUvN8omYnCp5Qft/9:76nce0TmlZHHAiFF0PYQuddN8ck67

Score

10^/10

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

december02.kozow.com:5151

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-O92SE5
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Targets

- Target
  
  DEMANDA LABORAL POR ABUSO DE CONFIANZA 1516947/1 DEMANDA LABORAL POR ABUSO DE CONFIANZA 151561.exe
- Size
  
  121KB
- MD5
  
  9c521a90653df5d1efbd0cea12318863
- SHA1
  
  ec2afaf10b78dabfead9e9e485d454789c244188
- SHA256
  
  85bcfc9de06bd0751245ad882f7e2141f340cdedefcaefb8deabbc0792088a58
- SHA512
  
  d1bbb5e07e7df5fe6da9786ecee06c0dfd9e46067de48a139323aa045f81139b78404c4f3f77b1f6f58c3b11d1edf88d0c06ad42fcf7482436367f2444e6152e
- SSDEEP
  
  1536:WMlHLXYAcNG6d2vlvPahT21HXNMMUpOh1lyDi8pgI7G/mJK:9raZ2AtmXmpXDiUgIK/MK
Score

10^/10

remcos remotehost discovery rat
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Remcos family
  remcos
behavioral1 behavioral2
- Target
  
  DEMANDA LABORAL POR ABUSO DE CONFIANZA 1516947/CiscoSparkLauncher.dll
- Size
  
  2.6MB
- MD5
  
  e2e01305e938ea378a88658d81c0917f
- SHA1
  
  6b3dc7e13347f6fadadc2dbac7d3a3927d9e2aa6
- SHA256
  
  29c3c48f4dc84e7179881bc3767546878b2db89d418372f687edbd4a72ef0989
- SHA512
  
  5620ea58d2a7da0fe5d352ea1fe82e76ed84c31b2ae97b28a3ab3b25268f21c0a8eef8ca7baa05ab0f2c80a8125fc7e2441065eda11259b1f636be7b3d6c202d
- SSDEEP
  
  49152:aGtlqOIU6iJVwASOcO81WPz3qjFr6t1Dt+w+PpmtsHcFhKgwzfQHdPWkpRs6:m+18rcDINHAhKQH8S
Score

10^/10

remcos remotehost discovery rat
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Remcos family
  remcos
behavioral3 behavioral4
- Target
  
  DEMANDA LABORAL POR ABUSO DE CONFIANZA 1516947/VERSION.dll
- Size
  
  6.7MB
- MD5
  
  6012e45afe8fe06f202eec3707754e7d
- SHA1
  
  afdaf6fa43c1114826a7ddbd8b6d5133fead17c9
- SHA256
  
  2424185f8e975bc8a289c9bf2f90bddb81f5263396eb89e7e8bfcf4720d3b7f8
- SHA512
  
  1d25c9a2a261e46aea803c6b7365272d3ad86194193c291b7e77b007b03cae9d4ef325802ab3d3a489e6d9edb856c5f70fdabdc4594b9d748c2a13417633597c
- SSDEEP
  
  98304:g/LcWDKVQZXpaZAPPlzQ212fcGVH/HcBEVG4PGYnTlEKDgHG468ESS1rP4D1U:ggWmwaZA312fPcYHTOKsmT8hurP4D
Score

1^/10
behavioral5 behavioral6