General
-
Target
RFQ_PO_08361284,pdf.rar
-
Size
446KB
-
Sample
210820-xl26b11dwx
-
MD5
62395bc337e4a71eaa47d5320800e612
-
SHA1
074fcd2c8d1682df17c07e27b99db65fd78aa2b9
-
SHA256
5033129de4258592effa6f57ddb97aa1028fae4ed9a6075654bb56f9be84d329
-
SHA512
0ea71b4c1c5065321be3b6dc7df5d413abbf978b57ccd56de5ec2022efeea1ee2e66816203109fff2d5fdf91e5a39c4a1b42b1b22d5ac0d96ba3c092117b914b
Malware Config
Extracted
remcos
OK MAN
zion6.ddns.net:2815
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Remcos-MPN2RF
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
notepad;solitaire;
Targets
-
-
Target
RFQ_PO_08361284,pdf.exe
-
Size
1.0MB
-
MD5
208d83597e8525b0868eaec636024d32
-
SHA1
613799e5457c8493276f96d25c05d054d3af5091
-
SHA256
76fd257f51e11637d0fb987ccd4c94d46b8a0d6d7f46d2785f836f912d63362f
-
SHA512
75fbface481124fee0d7f62020d91e8564bd415479ac62ae97f0db0f2a5251224c2e5065c4bf808b0db55b728de3863b784071a9aba33bfa373dba99d1236bb3
Score10/10-
Remcos
Remcos is a closed-source remote control and surveillance software.
-
Adds Run key to start application
-