General
-
Target
Documento de carta de porte de Dhl,pdf.iso
-
Size
744KB
-
Sample
210830-1fx9vebzgx
-
MD5
8a026c1f2def1f5b9188ee17c67b2fd3
-
SHA1
895c439106d9d7074b6f718992827b86634fc570
-
SHA256
fe6bb31e8c3f0439a6cc3c0b1446b959c0ad8486592f5a6736d9ce7a02009576
-
SHA512
63c545734dca5520e1bb76b281796d0478ddba13cbb23d39d1cab2b4049d4762a23fdb64d089adc5761aa06ec91b44c7e26742d6b71b5b8dddaf93d97f2a7047
Static task
static1
Behavioral task
behavioral1
Sample
Documento de carta de porte de Dhl,pdf.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
Documento de carta de porte de Dhl,pdf.exe
Resource
win10v20210408
Malware Config
Extracted
remcos
Global_New
godisgood247.duckdns.org:6397
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Remcos-FP4JCG
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
notepad;solitaire;
Targets
-
-
Target
Documento de carta de porte de Dhl,pdf.exe
-
Size
684KB
-
MD5
757cc6207682ec829c36a9e62fedc1d8
-
SHA1
8460c24b5d1ee1873265beb324e83e43d7f56816
-
SHA256
c1dfc207e54b30fc1686efaa9037af9aa07f47fbfb0beba70493e9fb383b4d8e
-
SHA512
5b817219982699a53a80a2f422738ea2c359a9db24f8ad4f20b5bad9eee32bb3dbe7de77eb750b1ce84d7d9b4b5c36168236f8a810bd0228971f6f0a9dfeb70b
Score10/10-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Adds Run key to start application
-