remcos

General

Target

DEMANDALABORALJURIDICA165161.zip
Size

6.1MB
Sample

241213-ttyxjatpd1
MD5

4e8ffa99552583730d92d29314b849fe
SHA1

d81530cadc8e5ab13ab8852a05660b279caab8a1
SHA256

b8188f527872f10923a81d13438c90637173a3062b47d4562b19e0eee21bce00
SHA512

845d4166860b781eb9d312919e255cd0e989b203e03e2f7295d126220c1abed4087a96ee0761e1f3c07bb52b97d8fc4cb13767d68009a4959bbf2745d42a489d
SSDEEP

98304:ggVYzL1pgfw8RoVFUHp3YtMOoQe9vZGp/mRhodqMWH/x0r4bgQhVvo+51CUqv62L:70LLgY8xxwD2ZaSO0JB0QzwmCbLP

Score

10^/10

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

december02.kozow.com:5151

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-O92SE5
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Targets

- Target
  
  DEMANDA LABORAL JURIDICA 165161/1 DEMANDA LABORAL JURIDICA 321321.exe
- Size
  
  121KB
- MD5
  
  9c521a90653df5d1efbd0cea12318863
- SHA1
  
  ec2afaf10b78dabfead9e9e485d454789c244188
- SHA256
  
  85bcfc9de06bd0751245ad882f7e2141f340cdedefcaefb8deabbc0792088a58
- SHA512
  
  d1bbb5e07e7df5fe6da9786ecee06c0dfd9e46067de48a139323aa045f81139b78404c4f3f77b1f6f58c3b11d1edf88d0c06ad42fcf7482436367f2444e6152e
- SSDEEP
  
  1536:WMlHLXYAcNG6d2vlvPahT21HXNMMUpOh1lyDi8pgI7G/mJK:9raZ2AtmXmpXDiUgIK/MK
Score

10^/10

discovery remcos remotehost rat
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Remcos family
  remcos
behavioral1 behavioral2
- Target
  
  DEMANDA LABORAL JURIDICA 165161/CiscoSparkLauncher.dll
- Size
  
  2.6MB
- MD5
  
  e2e01305e938ea378a88658d81c0917f
- SHA1
  
  6b3dc7e13347f6fadadc2dbac7d3a3927d9e2aa6
- SHA256
  
  29c3c48f4dc84e7179881bc3767546878b2db89d418372f687edbd4a72ef0989
- SHA512
  
  5620ea58d2a7da0fe5d352ea1fe82e76ed84c31b2ae97b28a3ab3b25268f21c0a8eef8ca7baa05ab0f2c80a8125fc7e2441065eda11259b1f636be7b3d6c202d
- SSDEEP
  
  49152:aGtlqOIU6iJVwASOcO81WPz3qjFr6t1Dt+w+PpmtsHcFhKgwzfQHdPWkpRs6:m+18rcDINHAhKQH8S
Score

10^/10

remcos remotehost discovery rat
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Remcos family
  remcos
behavioral3 behavioral4
- Target
  
  DEMANDA LABORAL JURIDICA 165161/VERSION.dll
- Size
  
  6.8MB
- MD5
  
  faa78a3123a7f231de7152bb15c7fa02
- SHA1
  
  c9562133f7630db6a84f4daf56b468c5b0891704
- SHA256
  
  e68265f0d7012e600dac0a25190c6bf4c65689165cb2cb31a60a37baad21064f
- SHA512
  
  622f9da91e1f4995136515120c6a2f5e7f43eb2007467d2633b7391c2777985b2557647ec7753c28d34014d5e83bc979298c245f2b3d6562e668d5c2e221faa4
- SSDEEP
  
  98304:NNxgVhCyX85tumfGOG83MQs/MAx6sVe9VYqljWkDlA4JJ2xHuRmZaMO:NAVhCB5tumhxMD/PxeqDPO
Score

1^/10
behavioral5 behavioral6