Overview

overview

10

Static

static

1

N-64574 JU...ES.msg

windows7-x64

10

N-64574 JU...ES.msg

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    N-64574 JUZGADO 004 MUNICIPAL DE PEQUEÑAS CAUSAS LABORALES.msg

  • Size

    91KB

  • Sample

    241212-rmqlgawqgs

  • MD5

    77f2e0973250e47757c97a5163df1ebc

  • SHA1

    72a7be688e78efd31a98214367db1fbdb7941c4d

  • SHA256

    fddf8bb336550656a2a9f7c5063092e77bfa127095317e25066c02a7170c0548

  • SHA512

    d08a1ea92875b670c0e66404c4ba5b8d418eccb9dd6c065805153654b1add7bcc0a42322e3b007efd5a422a7ab1270669ab558855ccc778ee42c51ae0a97a8dc

  • SSDEEP

    1536:ZtiMRFG9VWSWFCT3s4Fgt51+aYvVqqw0EOaFpyqqw0EOaFp:ZtiMjG9wJJYXaYa

Score
10/10
remcosremotehostdiscoveryrat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

december02.kozow.com:5151

Attributes
  • audio_folder

    MicRecords

  • audio_path

    ApplicationPath

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-O92SE5

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      N-64574 JUZGADO 004 MUNICIPAL DE PEQUEÑAS CAUSAS LABORALES.msg

    • Size

      91KB

    • MD5

      77f2e0973250e47757c97a5163df1ebc

    • SHA1

      72a7be688e78efd31a98214367db1fbdb7941c4d

    • SHA256

      fddf8bb336550656a2a9f7c5063092e77bfa127095317e25066c02a7170c0548

    • SHA512

      d08a1ea92875b670c0e66404c4ba5b8d418eccb9dd6c065805153654b1add7bcc0a42322e3b007efd5a422a7ab1270669ab558855ccc778ee42c51ae0a97a8dc

    • SSDEEP

      1536:ZtiMRFG9VWSWFCT3s4Fgt51+aYvVqqw0EOaFpyqqw0EOaFp:ZtiMjG9wJJYXaYa

    Score
    10/10
    remcosremotehostdiscoveryrat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Remcos family

      remcos

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks