General
-
Target
ORIGINAL DOCUMENTS BL, C.I. & PACKING LIST.ace
-
Size
1.2MB
-
Sample
211014-p9eflsheh4
-
MD5
5aa02a541240a0d727b87166863f617a
-
SHA1
9d0438eef842885d9813d8a7b83756a296bab352
-
SHA256
d3be4990232180223bb7788dbba4c8f86296d413314ba55b2bcd4842c5b5633e
-
SHA512
da755263533b9059884a779ded12739a68b198820337164770d733dea95c2e79d738193f06006be0fbbf6f7d7aa5080344d7e32ed93a281531197142e36b657e
Static task
static1
Behavioral task
behavioral1
Sample
ORIGINAL DOCUMENTS BL, C.I. & PACKING LIST.scr
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
ORIGINAL DOCUMENTS BL, C.I. & PACKING LIST.scr
Resource
win10-en-20210920
Malware Config
Extracted
remcos
3.3.0 Pro
OCTOBER-$$$$
mgc0147.hopto.org:2930
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Remcos-3MPDYA
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
notepad;solitaire;
Extracted
remcos
OCTOBER-$$$$
mgc0147.hopto.org:2930
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Remcos-3MPDYA
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
notepad;solitaire;
Targets
-
-
Target
ORIGINAL DOCUMENTS BL, C.I. & PACKING LIST.scr
-
Size
1.3MB
-
MD5
a0747b376c17728fe2731e9e98d1b017
-
SHA1
7917d0e5d6adfb0690455afdafbe81db00cfc41b
-
SHA256
870130235c0034bb2649c4268bfc3ff87de0fe2cf13d0af41ce0c0f397e5ea50
-
SHA512
58b934b044ce00910e8abf5c12b1bd25aeb9e5cd458740967e5d538ea13f0cb871595658e13da2acbf2dc3e3d94848ccd79cf64dca74b25d9a8c0d4337318585
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-