Overview

overview

10

Static

static

10

tmp.exe

windows7-x64

1

tmp.exe

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    tmp

  • Size

    469KB

  • MD5

    8b7a6c9925ce8e8bc5c70433518328ce

  • SHA1

    4e2a4cf5d369862002e5f11b3bf52fe27789c1ad

  • SHA256

    f925b063bdb5c518a812bdfc0281699c73819fa49d27f2a68d0d7c4b2dd9d604

  • SHA512

    a77ad12168542cec7dff6100687856a3c438cbe746f2774e0d2841c1e675ea97f468e0193e9e0a8f0272c599bf51fc45c60b652a005cb5aaba9ca8d9e44b94ba

  • SSDEEP

    12288:Ymnk7iLJbpIpiRL6I2WhSKQ9ZsfZQSSn9:IiLJbpI7I2WhQqZ7S9

Score
10/10
aaremcos

Malware Config

Extracted

Family

remcos

Botnet

aa

C2

141.95.84.40:3232

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    awcawc-QPK6DZ

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

Files

  • tmp
    .exe windows x86

    5d354883fe6f15fcf48045037a99fb7a


    Headers

    Imports

    Sections