Overview

overview

10

Static

static

10

KeFqM.exe

windows7-x64

1

KeFqM.exe

windows10-2004-x64

1

Resubmissions

19/11/2023, 08:33

231119-kgcn4aac2s 10

19/11/2023, 08:29

231119-kdnl7ahc79 10

Sharing

Copy URL Twitter E-mail

General

  • Target

    KeFqM.exe

  • Size

    462KB

  • MD5

    096492414fe97b8cc2740ef65e909f54

  • SHA1

    fffd440b2fb9e39598a3a1b533ab73b9f6015480

  • SHA256

    eb965d5e26d9c037a82b60bc4b9668b8e0a57f5e8a0247391f7e009dd4e4af2d

  • SHA512

    aa19432a1fe22672153b6c7a78ffe2b0d908f6f92e98772ae667528cd685f145ad92e7a430fec63973cc922ad5996b6e2cab48387e37af2faaf40670775f1abd

  • SSDEEP

    12288:9oCqKde3G314caiojGRoaOd+2sfZsSVg:eAdIG314cFo4Od+NZ3S

Score
10/10
mozillahost.exeremcos

Malware Config

Extracted

Family

remcos

Botnet

Mozillahost.exe

C2

msft.serveftp.com:443

87.98.236.198:443
Attributes
  • audio_folder

    MicRecords

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    30

  • connect_interval

    15

  • copy_file

    mozsync.exe

  • copy_folder

    Mozilla

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    true

  • install_flag

    false

  • install_path

    %AppData%

  • keylog_crypt

    true

  • keylog_file

    dbcache.db

  • keylog_flag

    false

  • keylog_folder

    Mozilla

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    MozillaSync-JR9JF9

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Mozilla Account

  • take_screenshot_option

    false

  • take_screenshot_time

    5

  • take_screenshot_title

    notepad;solitaire;

Signatures

  • Remcos family
    remcos
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • KeFqM.exe
    .exe windows:5 windows x86 arch:x86

    029a987f21e33b48f24d21b6f9ff1129


    Headers

    Imports

    Sections