General
-
Target
RFQ+202209.zip
-
Size
1.1MB
-
Sample
220915-mz865ageel
-
MD5
0d48d0d98553efe4d8e637993d5ae6aa
-
SHA1
aeef15d80f8e0413e81675ec8072a4c4f6839091
-
SHA256
a04aaf2bf84a97c525d32b13c673e8f50c0980c50e321afe8d51de9e243924a8
-
SHA512
3807fb40dbc2f9ecf9ee6de4122c3e8c6d0f2292450e4fe7a58890a3f43aae5c8e5d8805bb0c1fa11071a4e4e4168babe730eae9b0b2d8ab5cf99cec87aaa7dd
-
SSDEEP
24576:LinXyjslPH04q0Of8LA/+SgHs8ASKBaiE2Z/W3GIU:oPH04Qf8LArgmBaRwEGl
Static task
static1
Behavioral task
behavioral1
Sample
RFQ 202209.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
RFQ 202209.exe
Resource
win10v2004-20220901-en
Malware Config
Extracted
remcos
NEW REM STUB
valvesco.duckdns.org:5050
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-48V73L
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
-
Target
RFQ 202209.exe
-
Size
1.3MB
-
MD5
2eb993eae521117abeb184195490b57a
-
SHA1
7114649dc2116ff3ca020c05440464738c1ae13b
-
SHA256
5542dd26db06cbc6b03f1323db7ff6792a69bcf3dcd6a6c978b91018c7f0a0ee
-
SHA512
c29f10d3317c3f6fa06df0d30a0c3e2272068fe9b5860411d909b090d69211b1bae0d79a5bd77a73844ba075a73cb6c604d06c5e28e2b144baa00f7e00f9f2f0
-
SSDEEP
24576:Sl1XSjildH84qAc/8jAx6SgXIWA8KB4iEkz/K3h2:S/NH84I/8jA1geB4R2g
Score10/10-
NirSoft MailPassView
Password recovery tool for various email clients
-
NirSoft WebBrowserPassView
Password recovery tool for various web browsers
-
Nirsoft
-
Accesses Microsoft Outlook accounts
-
Suspicious use of SetThreadContext
-