General
-
Target
Yeni sipariş-po21019612_pdf.exe
-
Size
600KB
-
Sample
230328-hvcj5she44
-
MD5
7261bee09673cc990e13d26feee42c2a
-
SHA1
99ee353456daad13d299a3954acad8be28e5a2c8
-
SHA256
1abe11cf0a879b99c092a403e9efedf7ecda8e92c6708c31c799ce36c2da26a8
-
SHA512
3cf7e34c86c02250f8c1352f1ff876c4f25628c47390d5314f6324ee26e0641ee74db3df31dd68ed3e0d8bff4baf47f753c7a6e697a0cfebfac23d2d8027bba0
-
SSDEEP
6144:DjDeziqALNF1XuDsF1auOOf2Am3SnXIQia00rSo0oACyjUKAaWH5UDC2KiyHS9ei:Df8iqALNXBF19OABX7GHoACaUbSKMy
Static task
static1
Behavioral task
behavioral1
Sample
Yeni sipariş-po21019612_pdf.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Yeni sipariş-po21019612_pdf.exe
Resource
win10v2004-20230221-en
Malware Config
Extracted
remcos
RemoteHost
obologs.work.gd:34346
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-T1GOKT
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
-
Target
Yeni sipariş-po21019612_pdf.exe
-
Size
600KB
-
MD5
7261bee09673cc990e13d26feee42c2a
-
SHA1
99ee353456daad13d299a3954acad8be28e5a2c8
-
SHA256
1abe11cf0a879b99c092a403e9efedf7ecda8e92c6708c31c799ce36c2da26a8
-
SHA512
3cf7e34c86c02250f8c1352f1ff876c4f25628c47390d5314f6324ee26e0641ee74db3df31dd68ed3e0d8bff4baf47f753c7a6e697a0cfebfac23d2d8027bba0
-
SSDEEP
6144:DjDeziqALNF1XuDsF1auOOf2Am3SnXIQia00rSo0oACyjUKAaWH5UDC2KiyHS9ei:Df8iqALNXBF19OABX7GHoACaUbSKMy
Score10/10-
NirSoft MailPassView
Password recovery tool for various email clients
-
NirSoft WebBrowserPassView
Password recovery tool for various web browsers
-
Nirsoft
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook accounts
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-