Overview

overview

10

Static

static

1

1cc7e555ec...72.exe

windows7-x64

10

1cc7e555ec...72.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    21386897144.zip

  • Size

    1.2MB

  • Sample

    250214-xljpesxlfv

  • MD5

    71d643d825a1a95a77e7a6becc00d50d

  • SHA1

    e79977b3c7a1d848985911df7eb388ee1dff5b0c

  • SHA256

    9157e0b99eee7ee37c01875ab98917e4a7a84750238e35dc3c8f4f8fb8283beb

  • SHA512

    4b63d5c94a3afb4e946773a4c8ebf64c6679184ff6e7a6901c6df9917075cef50161b88e231e08da75d39dc8396cbe94c5d06bac5eb198bc2cf1bd57d080bf62

  • SSDEEP

    24576:ukXFtXl/jRSiqPSTv4kt7StDsX8dnVsAG2LPEOWR2+ttI9TI:LFtpvqPSB2tIMdqX7OCltI9TI

Score
10/10
remcosseguros bolivardiscoveryrat

Malware Config

Extracted

Family

remcos

Botnet

SEGUROS BOLIVAR

C2

donato.con-ip.com:6014

Attributes
  • audio_folder

    MicRecords

  • audio_path

    ApplicationPath

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    datos

  • mouse_option

    false

  • mutex

    udjgfhjdopajdfegvx-OY1HPL

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      1cc7e555ec93d6db3da2058e5b82ce41ff981930658c1d120e199cb4c133c672

    • Size

      1.2MB

    • MD5

      d5136bf33e6c76dcfdcedbb86e153afa

    • SHA1

      8fd48aaaadfa753ed53c9ebf0b10f7f2b74eab67

    • SHA256

      1cc7e555ec93d6db3da2058e5b82ce41ff981930658c1d120e199cb4c133c672

    • SHA512

      cd75cfd8be5eda22ffbcc5cda3cdea8717d1a31ba9a44a53840b7b9a33fe341a6d9f2b35707da3ca41ea729b9ac32f9e59807579ed3fd4b30e3a7c589d95a168

    • SSDEEP

      24576:iWLHBS7iz7Es33QQvbuIVxaLwb1RUcKEigkzATkMj9wzXD3W+U4ryTlob7Tb7j:ZrI7gEKQQvaIi81Wc8gbLILW+6Tla

    Score
    10/10
    remcosseguros bolivardiscoveryrat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Remcos family

      remcos

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates processes with tasklist

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks