General
-
Target
SecuriteInfo.com.W32.MSIL_Kryptik.BUN.gen.Eldorado.5299.27498.exe
-
Size
632KB
-
Sample
221206-mlkxdahh47
-
MD5
e30f54fde53e3ce74efae41927082cc4
-
SHA1
d68d467962c3d14504d1da9d5fa7f02cf0829bc8
-
SHA256
0e768f811e046c0f38205d11e2a58ee5aac2828c36f213bde4dbebba4b15d8d5
-
SHA512
de0e16ce24f00b7fe18f6d131671db9d3a65edf0c9dd62b2c9fb255042cb842ce466ecb38dbe57d3bf7877154a67414aca500cb50e8d341e589ea6dc88f42b81
-
SSDEEP
12288:otzRDlOtqdqET0r1FTtq9IC1NW04lEOhtKz3SVs5GpMZEnfOj:2tBOwjyIHulNtI3Sy5GGuu
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.W32.MSIL_Kryptik.BUN.gen.Eldorado.5299.27498.exe
Resource
win7-20220901-en
Malware Config
Extracted
remcos
UC
ucremcz1.ddns.net:1823
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
BIN.exe
-
copy_folder
BIN
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
true
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Rmc-X402GF
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
bin
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
-
Target
SecuriteInfo.com.W32.MSIL_Kryptik.BUN.gen.Eldorado.5299.27498.exe
-
Size
632KB
-
MD5
e30f54fde53e3ce74efae41927082cc4
-
SHA1
d68d467962c3d14504d1da9d5fa7f02cf0829bc8
-
SHA256
0e768f811e046c0f38205d11e2a58ee5aac2828c36f213bde4dbebba4b15d8d5
-
SHA512
de0e16ce24f00b7fe18f6d131671db9d3a65edf0c9dd62b2c9fb255042cb842ce466ecb38dbe57d3bf7877154a67414aca500cb50e8d341e589ea6dc88f42b81
-
SSDEEP
12288:otzRDlOtqdqET0r1FTtq9IC1NW04lEOhtKz3SVs5GpMZEnfOj:2tBOwjyIHulNtI3Sy5GGuu
-
Drops startup file
-
Suspicious use of SetThreadContext
-