General
-
Target
RFQ 090701-2021-PTSC-HTS-03 - 001.js
-
Size
27KB
-
Sample
210907-gqxtvafbgj
-
MD5
cc01cf8d821a2c3059fe6598d81c8037
-
SHA1
cbc52f57491f1f11c12d6ab3ee515c5149aaeeb1
-
SHA256
a745eea0381b55cf2efe28cd6172d38bb1284d49f3f1d506bc010c7be4cb8546
-
SHA512
d552bc4fd264805a48b33241d34b22cdc995bd8081a596da09c52fc085f79108c045611f839c1689ecc37d3ec75a4afe1e2f20b1ae93bd31985783966070de3b
Static task
static1
Behavioral task
behavioral1
Sample
RFQ 090701-2021-PTSC-HTS-03 - 001.js
Resource
win7-en
Malware Config
Extracted
remcos
3.2.0 Pro
Reed
ezfax2021.home-webserver.de:24133
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
iuis.exe
-
copy_folder
oiujhy
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
true
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
true
-
keylog_file
uhyg.dat
-
keylog_flag
false
-
keylog_folder
juhg
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
iuyhg-XOY14N
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
oiu
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
notepad;solitaire;
Targets
-
-
Target
RFQ 090701-2021-PTSC-HTS-03 - 001.js
-
Size
27KB
-
MD5
cc01cf8d821a2c3059fe6598d81c8037
-
SHA1
cbc52f57491f1f11c12d6ab3ee515c5149aaeeb1
-
SHA256
a745eea0381b55cf2efe28cd6172d38bb1284d49f3f1d506bc010c7be4cb8546
-
SHA512
d552bc4fd264805a48b33241d34b22cdc995bd8081a596da09c52fc085f79108c045611f839c1689ecc37d3ec75a4afe1e2f20b1ae93bd31985783966070de3b
-
suricata: ET MALWARE Remocs 3.x Unencrypted Checkin
suricata: ET MALWARE Remocs 3.x Unencrypted Checkin
-
suricata: ET MALWARE Remocs 3.x Unencrypted Server Response
suricata: ET MALWARE Remocs 3.x Unencrypted Server Response
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Drops startup file
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-