Overview

overview

10

Static

static

10

NEAS.f1daa...JC.exe

windows7-x64

1

NEAS.f1daa...JC.exe

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    NEAS.f1daa346bb216b4626ce62a802364698175ac0ce72dd10e2e334d296d13cb452exe_JC.exe

  • Size

    483KB

  • MD5

    95b2b03d866e13da1c42b7d4d4776f74

  • SHA1

    a86e9a0d196d29ffef9492584b72384c8011a691

  • SHA256

    f1daa346bb216b4626ce62a802364698175ac0ce72dd10e2e334d296d13cb452

  • SHA512

    0072b4bc5ba93e4a97e95f58efdbefeafa5ec8cc0d732916d02f6ec2dccab1e69b29a36e5bb7551ff8856ca154639584b3f609dbd8a8c1121a9ccfcda2fe1d8f

  • SSDEEP

    6144:G/7iPrcL3ArwhBq7Kjsn9iHGXg0lwGS9MNNhdFvPxps9gsAOZZuAXec7A7ov:G/uPq3AfK496Gw0lwGXN3pvs/ZuB8v

Score
10/10
qemu-garemcos

Malware Config

Extracted

Family

remcos

Botnet

Qemu-Ga

C2

179.61.237.12:443

drivebackupupdate.com:443

secure.cloudproxyserv.com:443
Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    6

  • connect_interval

    3

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    true

  • keylog_file

    profile.bin

  • keylog_flag

    false

  • keylog_folder

    Qemu-Ga

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    Qemu-Ga-DQ9NFC

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos family
    remcos
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • NEAS.f1daa346bb216b4626ce62a802364698175ac0ce72dd10e2e334d296d13cb452exe_JC.exe
    .exe windows:5 windows x86

    8d5087ff5de35c3fbb9f212b47d63cad


    Headers

    Imports

    Sections