General
-
Target
bin.zip
-
Size
1.6MB
-
Sample
230327-ygtjhafa33
-
MD5
644191706d44810f93c471970fe57655
-
SHA1
96c0302e17518fc8a1cfd1bd877dd2e6e7b4f055
-
SHA256
3edd7866a84cb13297c7bfa66202248858d0418bed730ba906c0a4a7c5652adc
-
SHA512
84757c7f5f7a3efbb46e274162be6459368d574e0d87820291f69956ed87a8568cf65751d456ad13a2b3f49ee096b8b0df8b40804ce515cb0bce69066b27721d
-
SSDEEP
12288:0/tOGOw13IIV0rgUmDACCZ3BqFwd/aDPvaERtYG:0AGjtJJUaMZ3BZlG
Static task
static1
Behavioral task
behavioral1
Sample
home/raid_service/casing_module/case_updater/tmppayload.exe
Resource
win7-20230220-en
Malware Config
Extracted
remcos
BILLETE
cactus.con-ip.com:7770
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-9927QM
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
-
Target
home/raid_service/casing_module/case_updater/tmppayload
-
Size
1024.0MB
-
MD5
932f4060cc31b4dbaffa1bb6d3991c20
-
SHA1
989f4fb91c3a30a0789c0d61c1b8c5dad659747e
-
SHA256
a40084ddc1d6655c2f78365a9ef6a9b81997cfa98a6f81c8d7dfe9619ef6b853
-
SHA512
7bb952847d5bacff9275415ba02a6fbeb180d16b2ef23591a60f9fe302f51301d7c967af5eaa5dc9135ceb108cdf25afdf745a3875b5b0655924452d1f753ba5
-
SSDEEP
6144:AxjCbYJafbpsBSM/HVFku/7AGLr5lw2H3SgoXraFjvVpQ+QW8uR3OoJWwvTTZlIY:+PozpsBzkuHPgDsvELuv7ZlIgCjIDF
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-