General
-
Target
Auftragsbestätigung _ Dringend,pdf.exe
-
Size
774KB
-
Sample
210907-lv3ccafegn
-
MD5
a054b5ea773679bfb29b1d191e8cd0be
-
SHA1
725d5412e942b55ee03331077863bc64aca5599e
-
SHA256
d7d94c81a09b9919714f7024a04a18e394198976107d3d9d35c56e69f2698ac8
-
SHA512
9dd1097933106df34504dc3f9f9cc1636698b660d7fbaaf6afd85b63e81908a13247adf911f82078df975f943f31cbc1f86970e8283702db067c5d6547d399ff
Static task
static1
Behavioral task
behavioral1
Sample
Auftragsbestätigung _ Dringend,pdf.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
Auftragsbestätigung _ Dringend,pdf.exe
Resource
win10-en
Malware Config
Extracted
remcos
3.1.5 Pro
OK MAN
zion6.ddns.net:2815
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Remcos-MPN2RF
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
notepad;solitaire;
Targets
-
-
Target
Auftragsbestätigung _ Dringend,pdf.exe
-
Size
774KB
-
MD5
a054b5ea773679bfb29b1d191e8cd0be
-
SHA1
725d5412e942b55ee03331077863bc64aca5599e
-
SHA256
d7d94c81a09b9919714f7024a04a18e394198976107d3d9d35c56e69f2698ac8
-
SHA512
9dd1097933106df34504dc3f9f9cc1636698b660d7fbaaf6afd85b63e81908a13247adf911f82078df975f943f31cbc1f86970e8283702db067c5d6547d399ff
Score10/10-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Adds Run key to start application
-