General
-
Target
e4746ebf4b7ff2021e96f7b618f441422045f28350da682a7c822da583190731
-
Size
481KB
-
Sample
220808-c2tt4seba9
-
MD5
d46bbac660041a565e4b72880ca1cb10
-
SHA1
13f83ff9e724fe75907710fd396b6018638e289a
-
SHA256
e4746ebf4b7ff2021e96f7b618f441422045f28350da682a7c822da583190731
-
SHA512
c952e3e7a788fd3939e87023e7783aec62f4f429ae0bfe01eca98328690b1458eae45a14f394f84dc0e6d4735051c96eb43200272b4edcda8cfae758900600d9
Behavioral task
behavioral1
Sample
e4746ebf4b7ff2021e96f7b618f441422045f28350da682a7c822da583190731.exe
Resource
win10-20220718-en
Malware Config
Extracted
remcos
RemoteHost
top.noneabusers.xyz:3033
144.91.123.87:3033
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
cleaner.exe
-
delete_file
false
-
hide_file
true
-
hide_keylog_file
true
-
install_flag
true
-
keylog_crypt
false
-
keylog_file
tgjkf.dat
-
keylog_flag
false
-
mouse_option
false
-
mutex
utyrfhgjfkbgs-N91Z2E
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
esijestyr
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
-
Target
e4746ebf4b7ff2021e96f7b618f441422045f28350da682a7c822da583190731
-
Size
481KB
-
MD5
d46bbac660041a565e4b72880ca1cb10
-
SHA1
13f83ff9e724fe75907710fd396b6018638e289a
-
SHA256
e4746ebf4b7ff2021e96f7b618f441422045f28350da682a7c822da583190731
-
SHA512
c952e3e7a788fd3939e87023e7783aec62f4f429ae0bfe01eca98328690b1458eae45a14f394f84dc0e6d4735051c96eb43200272b4edcda8cfae758900600d9
Score10/10-
Executes dropped EXE
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-