General
-
Target
SecuriteInfo.com.Win32.PWSX-gen.9839.6586.exe
-
Size
899KB
-
Sample
221205-v25wgsaf99
-
MD5
05b2fb25c00fc2625348ba0c2f4aa99e
-
SHA1
200f289cac848d18c5ef3016a8b513aa9dbbc3b6
-
SHA256
6aa386bb66df768b6a5b9cd24bc443e157905453ff014863dcd9fdf8b1eb3839
-
SHA512
bdf0d3abd8a18781808f31069ee8b5d2e09f2c17d39374b6a39c126908c161af96bfac01ce6b135089c4407f29479eb92d0b308e3da9eebf6d8a0584857e223b
-
SSDEEP
12288:jJbgesRmxckJ+l3wBLiBzwwK2vkUUnFqY3IvqmA4hajIw2yXN4WqMv7sQhgQm4Gg:2Ac93iLozBRGqYYvMEYCMXGkaKbFX
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Win32.PWSX-gen.9839.6586.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Win32.PWSX-gen.9839.6586.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
remcos
RemoteHost Reff
185.136.161.189:1960
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-IPL25E
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
-
Target
SecuriteInfo.com.Win32.PWSX-gen.9839.6586.exe
-
Size
899KB
-
MD5
05b2fb25c00fc2625348ba0c2f4aa99e
-
SHA1
200f289cac848d18c5ef3016a8b513aa9dbbc3b6
-
SHA256
6aa386bb66df768b6a5b9cd24bc443e157905453ff014863dcd9fdf8b1eb3839
-
SHA512
bdf0d3abd8a18781808f31069ee8b5d2e09f2c17d39374b6a39c126908c161af96bfac01ce6b135089c4407f29479eb92d0b308e3da9eebf6d8a0584857e223b
-
SSDEEP
12288:jJbgesRmxckJ+l3wBLiBzwwK2vkUUnFqY3IvqmA4hajIw2yXN4WqMv7sQhgQm4Gg:2Ac93iLozBRGqYYvMEYCMXGkaKbFX
Score10/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-