Overview

overview

10

Static

static

10

851b803413...e1.exe

windows7-x64

10

851b803413...e1.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    851b803413aebc153c1e5db95fb4e0f8e038c685dc4751e23fb2ed1766d830e1

  • Size

    471KB

  • MD5

    945f70020e9ad4bb6bfe817fcdb8a432

  • SHA1

    22a57f85a4fc81de674c0f49ee59c7532bfd8014

  • SHA256

    851b803413aebc153c1e5db95fb4e0f8e038c685dc4751e23fb2ed1766d830e1

  • SHA512

    d6ca4f219b7a7e004302bd79484f6a33ff7e0a3faee38918415f48eb70794f217979454313f8bc674dfccad9534bf57b4dbfaf6586c41ca4684ca20cf79b88e2

  • SSDEEP

    6144:UbdjQFiTrgVohW1ydxCrLkE7ZFCSq1zeH4L5WIMOHsAOZZL1XBcYxl4:UbdUYCohW1kMfkEbCSqxeYdsfZLpl4

Score
10/10
waltar-host 2023remcos

Malware Config

Extracted

Family

remcos

Botnet

waltar-Host 2023

C2

muwkege4.zapto.org:2290

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    qqs.exe

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    true

  • install_flag

    true

  • install_path

    %AppData%

  • keylog_crypt

    true

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    Rmc-5AOFL5

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    ksd

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

Files

  • 851b803413aebc153c1e5db95fb4e0f8e038c685dc4751e23fb2ed1766d830e1
    .exe windows x86

    c9b0c44044380df67a7de0c7865c0e2a


    Headers

    Imports

    Sections