Overview

overview

10

Static

static

10

0x00070000...75.exe

windows7-x64

10

0x00070000...75.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    0x00070000000133af-75.dat

  • Size

    475KB

  • MD5

    6b9fea839e48a935e0eefab76a2f7a1f

  • SHA1

    d8ab2fc1ac2b4d38f3995d45629563b829ea1053

  • SHA256

    6713faaedb6fc283b3ac7ce13457aa0ef5be4d9065e297b0d03c9bb2f1b73991

  • SHA512

    e0f83bc686a1218b6441647eff1844644b36f0178a7afc67d36c02782c3e2040b251adfb5a7269ffb0b4b05da287fafa7744ced598af7ef9a3f9ff524e1ac89c

  • SSDEEP

    6144:mGqPd7rxgdfHD0Tnt5eh+4CwineHvWyBKxrw/5ttwAMS6NZ0sAOZZ7QX3cUnoRq:mGAxQj0bTe04CLneHvW9rwbxs/Z7VRq

Score
10/10
ikmerro2023remcos

Malware Config

Extracted

Family

remcos

Botnet

IKMERRO2023

C2

5.2.68.82:1198

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    Explorer.exe

  • copy_folder

    ATM Machine

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    true

  • install_flag

    true

  • keylog_crypt

    true

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    1234567ME

  • mouse_option

    false

  • mutex

    12345ME-2V5C4Q

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Explorer

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

Files

  • 0x00070000000133af-75.dat
    .exe windows x86

    b1c8f7572a6db205362528e88fd3ff32


    Headers

    Imports

    Sections