Overview

overview

10

Static

static

10

0x000a0000...57.exe

windows7-x64

10

0x000a0000...57.exe

windows10-2004-x64

10

Resubmissions

19/12/2022, 02:53

221219-ddfg9aeb35 10

16/12/2022, 02:23

221216-ct8cjadh98 10

Sharing

Copy URL Twitter E-mail

General

  • Target

    0x000a00000001231e-57.dat

  • Size

    470KB

  • MD5

    6d624cf8044bd53db3c0b95d6086b2a8

  • SHA1

    68003b5ddb9cd25938cd06fdc0adc975318543b3

  • SHA256

    52628e6e0c36165409685bdb00461e26b6634078e78d068e9b1d82bccb11ca16

  • SHA512

    6684cdb733081c6ac394fab5f90a0ca1935bc176a45211e0aba1dd5deab24d925226b58bec9fd68fe2eb65b4c0643028f7a410f705bdf1b1ac9f04b0cef967c6

  • SSDEEP

    12288:ntmox/Sl5vkKtAXjsoZ8wHonsfZgL64x:tmW6l5vkKtAD8wIKZE

Score
10/10
remotehostremcos

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

84.21.172.33:5763

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    re.exe

  • copy_folder

    os

  • delete_file

    false

  • hide_file

    true

  • hide_keylog_file

    false

  • install_flag

    true

  • install_path

    %AppData%

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-5HG6IX

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

Files

  • 0x000a00000001231e-57.dat
    .exe windows x86

    658143f158f14e9bff661e164dfff376


    Headers

    Imports

    Sections