General
-
Target
???????? ?????????? DHL 09-29-21,pdf.exe
-
Size
802KB
-
Sample
210929-j2dapaebh5
-
MD5
5daf107161b273bb31f0c69cbaf8c7d6
-
SHA1
b2741cf7481fa04afc457b078eb1ce0af074a0c6
-
SHA256
c84c8a5d9ea1dbf1b5af8d75cd100faadc54a5a83ab952e1ba03068d9287b32c
-
SHA512
8275fa6d8d4117b7d3fe6acd161474cf23ffed7e591a2272a7a77689da711f983d019bd95a5613bd3e70d6ad9fa3e596d54f59ae2cf9de685ea3a02aa9aacec2
Static task
static1
Behavioral task
behavioral1
Sample
???????? ?????????? DHL 09-29-21,pdf.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
???????? ?????????? DHL 09-29-21,pdf.exe
Resource
win10-en-20210920
Malware Config
Extracted
remcos
3.1.5 Pro
ABLE GOD
ongod4ever.ddns.net:5652
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Remcos-8VTGWT
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
notepad;solitaire;
Targets
-
-
Target
???????? ?????????? DHL 09-29-21,pdf.exe
-
Size
802KB
-
MD5
5daf107161b273bb31f0c69cbaf8c7d6
-
SHA1
b2741cf7481fa04afc457b078eb1ce0af074a0c6
-
SHA256
c84c8a5d9ea1dbf1b5af8d75cd100faadc54a5a83ab952e1ba03068d9287b32c
-
SHA512
8275fa6d8d4117b7d3fe6acd161474cf23ffed7e591a2272a7a77689da711f983d019bd95a5613bd3e70d6ad9fa3e596d54f59ae2cf9de685ea3a02aa9aacec2
Score10/10-
Adds Run key to start application
-