General
-
Target
Payment Advice - W41901,pdf.exe
-
Size
1.1MB
-
Sample
210819-dtjgcry1bs
-
MD5
499c2c29f1f3936af28917c28b82d534
-
SHA1
66cc59df26cbd680be3a7cf10b31df0ff0dec229
-
SHA256
91ec6c67b47495684c3911f25b793efec0af28162200cf44b00c70308b8a52e8
-
SHA512
c27b9aa5ab5f4607a81d81044b5c8375fea4ef1f081d97f4d2a9e6ba9ce092701c829d39d0256fcb07f1fa510a8feba6bb7ccaeeeedf415f36f8fd54f9b7ab10
Static task
static1
Behavioral task
behavioral1
Sample
Payment Advice - W41901,pdf.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
Payment Advice - W41901,pdf.exe
Resource
win10v20210410
Malware Config
Extracted
remcos
NWANNE'M
goddywin.freedynamicdns.net:4108
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Remcos-PZWD60
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
notepad;solitaire;
Targets
-
-
Target
Payment Advice - W41901,pdf.exe
-
Size
1.1MB
-
MD5
499c2c29f1f3936af28917c28b82d534
-
SHA1
66cc59df26cbd680be3a7cf10b31df0ff0dec229
-
SHA256
91ec6c67b47495684c3911f25b793efec0af28162200cf44b00c70308b8a52e8
-
SHA512
c27b9aa5ab5f4607a81d81044b5c8375fea4ef1f081d97f4d2a9e6ba9ce092701c829d39d0256fcb07f1fa510a8feba6bb7ccaeeeedf415f36f8fd54f9b7ab10
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
suricata: ET MALWARE Remocs 3.x Unencrypted Checkin
suricata: ET MALWARE Remocs 3.x Unencrypted Checkin
-
suricata: ET MALWARE Remocs 3.x Unencrypted Server Response
suricata: ET MALWARE Remocs 3.x Unencrypted Server Response
-
Adds Run key to start application
-