General
-
Target
send.zip
-
Size
90KB
-
Sample
230505-b8b27sga46
-
MD5
6eb42d220f60c076f7accd00e99dff7c
-
SHA1
8d04ef21f9d4328b4e1bb32c0bc9f9ec6bd529e0
-
SHA256
0a4eae79f85d762c9c0d0afda7ad0accf4528e8ef31d0b4157dd286b99ae6f6f
-
SHA512
362552922c74d9e983ca5e167c0744e03704ab77047047fe761294684a641295a9c8067831c387a56cf5c748df0a91990fa4427bafbfc5799c37a2b5cc564e02
-
SSDEEP
1536:1nNcI+GXzclcooN9rbtfN/4BpMarESjHgU6FV6AGQeqYHI58u8sl7H5:1nWI+mzecooN9tfNQTM/iAUGN/nYH68G
Malware Config
Extracted
redline
135.181.11.39:33468
-
auth_value
8371c94cfa5b9230afb9ccb73536d331
Extracted
amadey
3.70
tadogem.com/dF30Hn4m/index.php
Extracted
remcos
dream
report1.duckdns.org:3380
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-3IC60X
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
-
Target
a.exe
-
Size
5KB
-
MD5
e85d1bf9541e208169c02ae367c3a483
-
SHA1
adf5ba9458aec68633f154990dde8dbd7727f999
-
SHA256
f6dea983f6b6724da33e751a66857ae242e8a948aa4b3c8512416df203e3dbc9
-
SHA512
8c272c18bed6248c85ef86bddb53f3d2a842100197a8d0ce147f19c9af5775ac27da6a9ab98ce0357ed17fa86a133ec59aac8fd7adf94796251e274e2a797b9c
-
SSDEEP
96:+jfXEXA5ROFruevXvAADDxtMkY6pOssvNzNt:ifkTrXvbTMkY2OHn
Score10/10-
Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
-
Aurora
Aurora is a crypto wallet stealer written in Golang.
-
Gh0st RAT payload
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Remcos
Remcos is a closed-source remote control and surveillance software.
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Uses the VBS compiler for execution
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
-
-
Target
s.txt
-
Size
285KB
-
MD5
adc66e72450361ce494c2d3380670ff9
-
SHA1
467484750d09ec66fc17686b10deb57bfa23a423
-
SHA256
113a87ec1be61059a3b13f9ccb43ea18d5ca644949ad8f6d6d5e4056aa33cebc
-
SHA512
309a98e95471f4159cd7a4cf7714c72eba3b8dda48bdac7aaf19d2ccf0efc2945e90daf430c6f007573e074408dafc7e07b00929fba6b073ca7480b69b3fff95
-
SSDEEP
6144:arXHD4stFNh097hUwg9/1MHwgxxNg7p89bLY9YocTckbd7oY+3gLC4rbyyt9/N/F:arXHdNh097hUwg9/1MHwgxxNg7p89bL9
Score1/10 -