General
-
Target
379d64b633cf00cd32b301610d7b8a5808d6f48171b1e5ed93f77ca3a38d0b22
-
Size
190KB
-
Sample
220521-b2cedsfher
-
MD5
ad51f097cb2122fb7ab8f096133c7c57
-
SHA1
fb50563a7c3362f24b9e5341fc673ac8e73952ef
-
SHA256
379d64b633cf00cd32b301610d7b8a5808d6f48171b1e5ed93f77ca3a38d0b22
-
SHA512
6c32e8f1280c0bd2df93bf9e2147bb33dbe6349a47c65dec86fc0163c589771537a778c370d7e3fc7785b3ed7ce8c584af08dbf16759d48c877e6b95e6381758
Static task
static1
Behavioral task
behavioral1
Sample
Purchase_Order#PO7211A20_RFQ_Hangzhou_Zhongniu_Import_Export_Co.exe
Resource
win7-20220414-en
Malware Config
Extracted
remcos
2.5.0 Pro
CONTACTS
194.5.97.48:2404
-
audio_folder
audio
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
5
-
copy_file
remcos.exe
-
copy_folder
remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
true
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Remcos-FF7IUM
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
1
-
startup_value
remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
- take_screenshot_title
Targets
-
-
Target
Purchase_Order#PO7211A20_RFQ_Hangzhou_Zhongniu_Import_Export_Co.exe
-
Size
275KB
-
MD5
eb0755f5ec28980f4f492b579db4d5d9
-
SHA1
1ccb7d6603ecae8ecb19a15201d541b2a2b59eba
-
SHA256
5bf321a896fab855e09057d986bb3ac868a7d0a2aad468dd5dba498c6ed18357
-
SHA512
d728d2f367a3cefdbd47509b3a5f9db5dbd0d16f279aa87f17c78122302824c83fbfa948b2d8e9e088569792a6d65975279f565bcd5cf6e4fb545a1cb111ae1e
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-