General
-
Target
d7c1a65e2a6bf3878bc533b7456775fd91e41ea88df4e1baee624f6fc0776d4c
-
Size
344KB
-
Sample
220521-cgsfjsdhb9
-
MD5
4eb117d50bf42de8aa09ec7569ebaea9
-
SHA1
a510e598115e7f15a12cc14383a6ee0c8285cfe5
-
SHA256
d7c1a65e2a6bf3878bc533b7456775fd91e41ea88df4e1baee624f6fc0776d4c
-
SHA512
134d4f06f361649be9b328d9d3679c71841b3ddfa057812152d3e7f98bf7d9e96634afae2353610d4bb0a9a1722f0de4f111b99d66edfed10906b688041f1d77
Static task
static1
Behavioral task
behavioral1
Sample
SVCL 주문 문의 #20201305,pdf.exe
Resource
win7-20220414-en
Malware Config
Extracted
remcos
2.5.0 Pro
JAH BLESS
godsfavoured.ddns.net:7213
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Remcos-52S6QD
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
wikipedia;solitaire;
Targets
-
-
Target
SVCL 주문 문의 #20201305,pdf.exe
-
Size
284KB
-
MD5
726053b1a0320bbb7d4401b7c58571ac
-
SHA1
aee9558877f8f150fbecb331a89311caa7fb33e6
-
SHA256
9c163291baa89e2279a2ab8c2db63f8566b3d0b49bbd3b5254673ad2708b0866
-
SHA512
54b286249b4836d7aae4626abcb23a85b10b26939f41fc601b8599657c8018acdb68880435248c21ba8b4d8e38c18b201ebd5560ddb45ad29ee8887152a9ed61
Score10/10-
CoreEntity .NET Packer
A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Uses the VBS compiler for execution
-
Suspicious use of SetThreadContext
-