Overview

overview

10

Static

static

10

4f138cd5c0...8c.exe

windows7-x64

1

4f138cd5c0...8c.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b42aeffda940fb929770f7fac1d151f8.bin

  • Size

    262KB

  • MD5

    6c2ada4c6314190f8b3104ba8f656833

  • SHA1

    708f0808b5945ead3f6b89abf58ff4be73b49949

  • SHA256

    bf97d8b854216bb6db30c6bc4538410fbdf507a8b1cf64026390a7352b246a85

  • SHA512

    b959c4765eca5a482496e9151af7bf05505bac393a80b8d0de86740d38571026d7624932f8d4353f89cc57f5056c3abe1e0faad6fdd436a6be816c83b7957980

  • SSDEEP

    3072:FoU4fHpQAvpWu5VR2D3oxs6TfZCJyeeGnb7A/kj1zrDmVdaWbAitrlNQvP0LPQQ/:eUopzBDbR2DX6NeeGnIGzWDHDyePZd

Score
10/10
nnnremcos

Malware Config

Extracted

Family

remcos

Botnet

NNN

C2

newrqas1.duckdns.org:1214

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-EBAKLQ

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos family
    remcos
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • b42aeffda940fb929770f7fac1d151f8.bin
    .zip

    Password: infected

  • 4f138cd5c06d63316037e0622fa6c9e91a6798c78a45730777296c332dc4b98c.exe
    .exe windows x86

    Password: infected

    3f3d4ba55ce3e8f736704310c56bf5aa


    Headers

    Imports

    Sections