Overview

overview

10

Static

static

10

P3.exe

windows7-x64

1

P3.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    P3.exe

  • Size

    477KB

  • MD5

    7b376db5825738e8ce251fe6ab9c3310

  • SHA1

    ad2132e08ecbce1c7110f32b332e9da2a6f4127c

  • SHA256

    ba9c8000ac307785c3e32297d772a53e0ccf6fab0e2a40930a465bce160e9d63

  • SHA512

    e9165d4432a1b6ad7a4337a814f06b5fa9df8cada738089ecc14bb1a27cf040f8ad13c63f7301582fdec6fd0ba032e9a62fc91f1a61f0b2efc2c28cb2acda8b1

  • SSDEEP

    12288:SX8/Vx65HCnDAByqulR1fZJQGs/Z87Rq:5/Vc5HCnDABMfZJQNZC

Score
10/10
mayo 02 scrubcryptremcos

Malware Config

Extracted

Family

remcos

Botnet

MAYO 02 ScrubCrypt

C2

helisaclou.helisaclou.com:2203

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    Acobatlg.exe

  • copy_folder

    edqelofh

  • delete_file

    false

  • hide_file

    true

  • hide_keylog_file

    false

  • install_flag

    false

  • install_path

    %AppData%

  • keylog_crypt

    true

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    oxdligf

  • mouse_option

    false

  • mutex

    runfazsd-UZAJNW

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Acobatlg

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos family
    remcos
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • P3.exe
    .exe windows x86

    b1c8f7572a6db205362528e88fd3ff32


    Headers

    Imports

    Sections