General
-
Target
ORIGINAL DOCUMENTS BL, C.I. & PACKING LIST.scr
-
Size
1.3MB
-
Sample
211023-kkvzvacca7
-
MD5
a0747b376c17728fe2731e9e98d1b017
-
SHA1
7917d0e5d6adfb0690455afdafbe81db00cfc41b
-
SHA256
870130235c0034bb2649c4268bfc3ff87de0fe2cf13d0af41ce0c0f397e5ea50
-
SHA512
58b934b044ce00910e8abf5c12b1bd25aeb9e5cd458740967e5d538ea13f0cb871595658e13da2acbf2dc3e3d94848ccd79cf64dca74b25d9a8c0d4337318585
Static task
static1
Behavioral task
behavioral1
Sample
ORIGINAL DOCUMENTS BL, C.I. & PACKING LIST.scr
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
ORIGINAL DOCUMENTS BL, C.I. & PACKING LIST.scr
Resource
win10-en-20211014
Malware Config
Extracted
remcos
3.3.0 Pro
OCTOBER-$$$$
mgc0147.hopto.org:2930
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Remcos-3MPDYA
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
notepad;solitaire;
Targets
-
-
Target
ORIGINAL DOCUMENTS BL, C.I. & PACKING LIST.scr
-
Size
1.3MB
-
MD5
a0747b376c17728fe2731e9e98d1b017
-
SHA1
7917d0e5d6adfb0690455afdafbe81db00cfc41b
-
SHA256
870130235c0034bb2649c4268bfc3ff87de0fe2cf13d0af41ce0c0f397e5ea50
-
SHA512
58b934b044ce00910e8abf5c12b1bd25aeb9e5cd458740967e5d538ea13f0cb871595658e13da2acbf2dc3e3d94848ccd79cf64dca74b25d9a8c0d4337318585
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-