General
-
Target
New-Order-List-_-Specification.zip
-
Size
1.2MB
-
Sample
211014-h29s8agddn
-
MD5
cf71051dc29747c297ed5b80167a64bb
-
SHA1
8cb79a71cc683007430be4008c0b140a87acd486
-
SHA256
9161ed38d16be56e3242e33c3ccccad63f206db7a44e172163916322de79bd65
-
SHA512
edb28465070163a4f2f12373c3b91a6a33c8bd3e2bc5e1a90317d92a82ab7b852dd3cd7778dcc0e09b214dc407a9ce8294f415892cfedcca2200f17dc77d324e
Static task
static1
Behavioral task
behavioral1
Sample
New Order List & Specification.scr
Resource
win7v20210408
Behavioral task
behavioral2
Sample
New Order List & Specification.scr
Resource
win10-en-20210920
Malware Config
Extracted
remcos
3.3.0 Pro
OCTOBER-$$$$
mgc0147.hopto.org:2930
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Remcos-3MPDYA
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
notepad;solitaire;
Extracted
remcos
OCTOBER-$$$$
mgc0147.hopto.org:2930
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Remcos-3MPDYA
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
notepad;solitaire;
Targets
-
-
Target
New Order List & Specification.scr
-
Size
1.3MB
-
MD5
39f59475d4b4672638a90ac2e475cd90
-
SHA1
0fdabe47559fab6484f383fab08a451be9879f65
-
SHA256
13a65e23f4c45234d2e73ce746b29a13b10df6f5a7508087029432aa62d458c5
-
SHA512
f26355f9da0afa11fcc8782bad79c293735ba7a099f54b9bd60195122f9e7687ac322f93eba5d0caa7c0f2d49e7a4ce4f464bbb6cf08efb71e0cc998511b8b9d
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-