Overview

overview

10

Static

static

10

18a77944e8...b2.exe

windows7-x64

1

18a77944e8...b2.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    18a77944e8916fe26a93838b65be15b2.exe

  • Size

    469KB

  • MD5

    18a77944e8916fe26a93838b65be15b2

  • SHA1

    56af60dbe73dbbe185d5ec938e098faced7d1eb0

  • SHA256

    689323dc47d3476660644491b366eac3c1db47e20204b01659f15ab0e807e546

  • SHA512

    52802276cb1689f39a133691f6466af1b1ccf0d2968134293616384f33bfdc3e2a1870650d8137c27faef1b9ac47aa9d619da7e9605020539953a3b30be28e7b

  • SSDEEP

    12288:Wmnk7iLJbpIpiRL6I2WhSKQ9ZsfZQSrn9:uiLJbpI7I2WhQqZ7r9

Score
10/10
go_awayremcos

Malware Config

Extracted

Family

remcos

Botnet

Go_Away

C2

sallyfosterjones.com:5230

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    msword.exe

  • copy_folder

    office

  • delete_file

    false

  • hide_file

    true

  • hide_keylog_file

    true

  • install_flag

    false

  • keylog_crypt

    true

  • keylog_file

    reader.dat

  • keylog_flag

    false

  • keylog_folder

    office365

  • mouse_option

    false

  • mutex

    dtx-SEXRWG

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    reader

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

Files

  • 18a77944e8916fe26a93838b65be15b2.exe
    .exe windows x86

    5d354883fe6f15fcf48045037a99fb7a


    Headers

    Imports

    Sections