General
-
Target
2.ps1
-
Size
7.3MB
-
Sample
210927-vceyrshec2
-
MD5
393fec5bf34908cda642561ebe5c42d6
-
SHA1
db99e9e7e1186b1d9f786b5eab6f7b7f0246aec6
-
SHA256
389b1b2cb74af907c68a05463169e5ce36fee1da48f12d091d93aefcde36481f
-
SHA512
9ce0be56c31fe24a2e221a825ce9313e8fa096cc5c45a79525fa1ffb0c0d0e62127e0356b750936311e15b88d366512853e93f419037640770ae52f4d97bfb3e
Static task
static1
Behavioral task
behavioral1
Sample
2.ps1
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
2.ps1
Resource
win10v20210408
Malware Config
Extracted
remcos
3.2.0 Pro
Sys32
135.181.140.182:4783
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
true
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
true
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
Logs
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
SYS32-S57R8C
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
notepad;solitaire;
Targets
-
-
Target
2.ps1
-
Size
7.3MB
-
MD5
393fec5bf34908cda642561ebe5c42d6
-
SHA1
db99e9e7e1186b1d9f786b5eab6f7b7f0246aec6
-
SHA256
389b1b2cb74af907c68a05463169e5ce36fee1da48f12d091d93aefcde36481f
-
SHA512
9ce0be56c31fe24a2e221a825ce9313e8fa096cc5c45a79525fa1ffb0c0d0e62127e0356b750936311e15b88d366512853e93f419037640770ae52f4d97bfb3e
-
Suspicious use of SetThreadContext
-