General
-
Target
SPECIFICATIONS DATA.rar
-
Size
627KB
-
Sample
211022-llhataccfm
-
MD5
0de7b48b30b441120355551db7edd6e0
-
SHA1
3eab899084a263435cc6c4374ed89e1d37893485
-
SHA256
6f7fb8ed20a69d61a91da51303b54d7b169d32ed6c43c3441c7d8b71ec2ddebd
-
SHA512
3bd56a1eecc0d7d3095230d7e79b28300b33aaeea1bb026d7570dae17d1bdb3250ff6853b577e475550392e07f07068df2013aea7467085bc7ea1e813fa2e653
Static task
static1
Behavioral task
behavioral1
Sample
SPECIFICATIONS DATA.exe
Resource
win7-en-20211014
Malware Config
Extracted
remcos
3.1.4 Pro
servers
kashbilly2.ddns.net:6060
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Remcos-XI8GX1
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
notepad;solitaire;
Targets
-
-
Target
SPECIFICATIONS DATA.exe
-
Size
765KB
-
MD5
6cfab0d526994b9b98582a693fa58fc1
-
SHA1
16deda32ed2a9268e9bfc4d23d21a519cf720fb8
-
SHA256
353fc4210bc103d84f0a67dfd4a1a32762484f51d7af15da4080c8efd2752a5a
-
SHA512
3d11e04effbf50f57cf2879c71c8bffc6d17b3f973e1b0fffdcc816d178656c262a0fe0fe301670abd034abcb6ba09969452cab4ead67d5ff8407f87dbacfd38
-
Suspicious use of SetThreadContext
-