General
-
Target
QUOTE # EM067022.zip
-
Size
2KB
-
Sample
220930-rwtz9adgh4
-
MD5
7a196c1cf5884c84b05792767aa5e2e8
-
SHA1
11a060e358a844c02c8e0152a6b47cde18f7e0a7
-
SHA256
709bbba61869b8d1858198010a92226f4ea1fb7d2c95dc33fbec4262980327ac
-
SHA512
b530dbe0f13bea87df8733975afb5e125f6fc531188a1f7712552ef0b6518ff928abd68119b697ba1a294599f11f1c3834ee8eba7ac0ab7757bdd7bd9208b95c
Static task
static1
Behavioral task
behavioral1
Sample
QUOTE # EM067022.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
QUOTE # EM067022.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
remcos
RemoteHost
172.111.234.110:5888
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-ULBEJI
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
-
Target
QUOTE # EM067022.exe
-
Size
6KB
-
MD5
588dc78669c70ad45eefa0f2f7497815
-
SHA1
b90622241361b61445565eb15404dfbfa53561e4
-
SHA256
85d306912be80587264953469ca21f62da4c6b7cd1913b794787a563f90ef48c
-
SHA512
c57ad96fd559abebef976f41a30bb1cca86f3dc725765100bd6d7ba26bd673838d88df8ed9b748534a2d9ba681e4fe27c8fd291772c736141017c5ebf07f0ab3
-
SSDEEP
96:P/0MlfkKuMroRDQU2BwI47oxCXkMa/kjEthqFnU:3RZnctQUbIYXrasQrf
-
NirSoft MailPassView
Password recovery tool for various email clients
-
NirSoft WebBrowserPassView
Password recovery tool for various web browsers
-
Nirsoft
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook accounts
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-