Overview

overview

10

Static

static

10

Draft MBL.exe

windows7-x64

10

Draft MBL.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    Draft MBL.exe

  • Size

    469KB

  • MD5

    c44e1e2ba57bba432e4699bd25bd6be9

  • SHA1

    05e4522544434a9cd940ca389de70c231c9260ca

  • SHA256

    01304c92721e17fea51265cdb72ac92ddfadd72cdf2a69b6316d2fcea6142472

  • SHA512

    0645b4103b0df43d6183c33033109c3af14d0494cc0603b432464c21a36835d6a965a44f8562c3b4617efb8625776f71b0ba0e6265d5afffaf55bd664cf8909b

  • SSDEEP

    12288:Wmnk7iLJbpIpiRL6I2WhSKQ9ZsfZQSjn9:uiLJbpI7I2WhQqZ7j9

Score
10/10
remotehostremcos

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

drremcoz1.ddns.net:1307

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    true

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-51BI37

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

Files

  • Draft MBL.exe
    .exe windows x86

    5d354883fe6f15fcf48045037a99fb7a


    Headers

    Imports

    Sections