General
-
Target
0da9e22388ed115d5e70170880ce75efcc2c05be05f720b02e7dbfe351ebe92a.exe
-
Size
477KB
-
MD5
ebb60f0ff5d4fb966e59dd5a2104d727
-
SHA1
64d7716429399c15da51e05b58c6a4988349aa8a
-
SHA256
0da9e22388ed115d5e70170880ce75efcc2c05be05f720b02e7dbfe351ebe92a
-
SHA512
2c0dc7d5b8dc62752684d23b4f7ee7cd22c915c0532b4902d8eb1208150c452e0225b0248da84d222ab59a2e5c45109dcd77cbf1fd9af8e9e87944dbb8714a59
-
SSDEEP
12288:P/kfNBqpXKbQhqSm9JRxG5K0TKA0s/ZsJRq:EfN8pXKbQh6xG5hTlPZ8
Score
10/10
Malware Config
Extracted
Family
remcos
Botnet
esista
C2
85.217.144.119:4031
Attributes
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
mysoftware.exe
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
true
-
install_flag
true
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
software.dat
-
keylog_flag
false
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
mysoftware-XULZH6
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
mysoftware
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
0da9e22388ed115d5e70170880ce75efcc2c05be05f720b02e7dbfe351ebe92a.exe
Headers
Sections