remcos | 98eee0791e9e33bc16140ed6dc2a68ace15cb42f78408790e0278bc24c8416a1 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

98eee0791e9e33bc16140ed6dc2a68ace15cb42f78408790e0278bc24c8416a1
Size

475KB
Sample

230329-w67rbahd74
MD5

d606a39261a0599154ba54ec565fd602
SHA1

a209f005113b98482feee5e6cc312d5e0b4a1085
SHA256

98eee0791e9e33bc16140ed6dc2a68ace15cb42f78408790e0278bc24c8416a1
SHA512

eed142b5dd29a6dc5c34dd3f2f77e4950a5f89f82d51468f6882cf1cc024cacb5750c7540f7559705e03f0403a24498676b05346cfd299f731f766a47b019930
SSDEEP

12288:FjdAK8wxqkXuxOqLXO3X2orpbKs/ZgDfBRq:LA3wxqkXuxOq+rpbRZqz

Score

10^/10

remcos a

Malware Config

Extracted

Family

remcos

Botnet

A

C2

185.246.220.130:2987

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
true
install_flag
false
keylog_crypt
false
keylog_file
bcvgs.dat
keylog_flag
false
keylog_path
%AppData%
mouse_option
false
mutex
ncvuoa-AMG8M0
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Targets

- Target
  
  98eee0791e9e33bc16140ed6dc2a68ace15cb42f78408790e0278bc24c8416a1
- Size
  
  475KB
- MD5
  
  d606a39261a0599154ba54ec565fd602
- SHA1
  
  a209f005113b98482feee5e6cc312d5e0b4a1085
- SHA256
  
  98eee0791e9e33bc16140ed6dc2a68ace15cb42f78408790e0278bc24c8416a1
- SHA512
  
  eed142b5dd29a6dc5c34dd3f2f77e4950a5f89f82d51468f6882cf1cc024cacb5750c7540f7559705e03f0403a24498676b05346cfd299f731f766a47b019930
- SSDEEP
  
  12288:FjdAK8wxqkXuxOqLXO3X2orpbKs/ZgDfBRq:LA3wxqkXuxOq+rpbRZqz
Score

1^/10
behavioral1

MITRE ATT&CK Matrix

Tasks

static1

behavioral1