General
-
Target
INQUIRY 202209SCS.rar
-
Size
820KB
-
Sample
220919-khyyqacfbl
-
MD5
2e88b28a6ef2263a99cbbc014e1ee791
-
SHA1
a6f06d8466101a04533696146cf296a3e987d675
-
SHA256
46843628bf45d76b6592ba92e87df2a1a1cd0b661a490d4deb6c499d2897f508
-
SHA512
a0bd5ebe06751c3f2eec4017def72f3597cf7348658562183901629896b2ffd82e3cbac36730a86bbda3b7ddd73ee185d671aeeff01aba3391b29592d7ade090
-
SSDEEP
12288:mED+X/ZoDtuR43jFAhgdk1jWolfJMcP8m7DwAAmxUKG1Sx7924+IrbFApu:vqX6J3jkIkJfMcb7UmxHGUx73+iAI
Static task
static1
Behavioral task
behavioral1
Sample
INQUIRY 202209SCS.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
INQUIRY 202209SCS.exe
Resource
win10v2004-20220901-en
Malware Config
Extracted
remcos
NEW REM STUB
valvesco.duckdns.org:5050
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-48V73L
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
-
Target
INQUIRY 202209SCS.exe
-
Size
1.0MB
-
MD5
fd6f72c5d462fe0430e91f610747f0b7
-
SHA1
628203820d5c783b2985c8a653fc5fc3144a1a39
-
SHA256
2068d6dc1ef76f480e3fefd9fb239555d5f136c6c94d35232c273414ef4531f6
-
SHA512
98fb7a016c8ebeca9a23c6cd98d444c773eb2f71ec3b402458c433bbd5b5a32e46e0f6a149acc670811d8fb669786b8ff726040769dc841b144282deb05e3ae6
-
SSDEEP
12288:7ciYxpcVgA05HSleVr4DLCMrVuEPx940LsM8wFZI0jf6Xy6tynhvsLx8qszEEW:ccWylAoPPb40j8gI0m1yhEL/N
Score10/10-
NirSoft MailPassView
Password recovery tool for various email clients
-
NirSoft WebBrowserPassView
Password recovery tool for various web browsers
-
Nirsoft
-
Accesses Microsoft Outlook accounts
-
Suspicious use of SetThreadContext
-