General
-
Target
e30b26ce154af3e9e743c557dfe49071
-
Size
832KB
-
Sample
210915-hqya2saad2
-
MD5
e30b26ce154af3e9e743c557dfe49071
-
SHA1
d38122696b55c3121e9d58d8cbdd2b3400dba610
-
SHA256
da518c888f3041f6b13de0f7c54ac9429efa87a8c78fd426f81bd45d8dc66d8e
-
SHA512
be977eb665ffdcc468776e4c28983cded2390d29c8bf0c4f1db1744754caeeff08d4ec52712d71d306e8ac28df74e3c5e70232d1909556609ee6c427bc3758e4
Static task
static1
Behavioral task
behavioral1
Sample
e30b26ce154af3e9e743c557dfe49071.exe
Resource
win7-en
Malware Config
Extracted
remcos
3.2.0 Pro
Sys32
135.181.140.182:4783
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
true
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
true
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
Logs
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
SYS32-S57R8C
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
notepad;solitaire;
Targets
-
-
Target
e30b26ce154af3e9e743c557dfe49071
-
Size
832KB
-
MD5
e30b26ce154af3e9e743c557dfe49071
-
SHA1
d38122696b55c3121e9d58d8cbdd2b3400dba610
-
SHA256
da518c888f3041f6b13de0f7c54ac9429efa87a8c78fd426f81bd45d8dc66d8e
-
SHA512
be977eb665ffdcc468776e4c28983cded2390d29c8bf0c4f1db1744754caeeff08d4ec52712d71d306e8ac28df74e3c5e70232d1909556609ee6c427bc3758e4
-
Suspicious use of SetThreadContext
-