Overview

overview

10

Static

static

10

f6847b746e...e3.exe

windows7-x64

1

f6847b746e...e3.exe

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    5975711864464801addae436268ac804.bin

  • Size

    259KB

  • MD5

    83da90a929cdc6fea5a9f2f28337311d

  • SHA1

    17741cf5979d4c0d9271a74b1828e9e8ff943dbc

  • SHA256

    7c740bbc1a777efa2423464077463a9ccb25f85ad5462df474a04684975a0e94

  • SHA512

    3a1d1cdcb593f38439345e9d0a0a953a64cf331c570323087ba6d7a34e10a7a0e27f1855df6dde6527fb661e0ad5d3c46f7f017f328e423e7f80e2f47fdd1813

  • SSDEEP

    6144:tpunmq+sI74YF0zpI7RG9AIRoTa/5XCn5s3QODjG+:LWms9YvRGHRlZCe3QODjG+

Score
10/10
tilin1remcos

Malware Config

Extracted

Family

remcos

Botnet

tilin1

C2

contifico.con-ip.com:2427

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    true

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logslivet1.dat

  • keylog_flag

    false

  • keylog_folder

    logslive

  • mouse_option

    false

  • mutex

    Rmcaut1-WU95D7

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

Files

  • 5975711864464801addae436268ac804.bin
    .zip

    Password: infected

  • f6847b746e97fbfbf29670e635317472fbfd5524e1f2d9d34bf78a3d15e9a7e3.exe
    .exe windows x86

    Password: infected

    658143f158f14e9bff661e164dfff376


    Headers

    Imports

    Sections