General
-
Target
b07907ce3ee14b8128039ecb8e635976fc216c77035d5bf38f42ed900197c879exe.exe
-
Size
326KB
-
Sample
231130-t93knaeb9s
-
MD5
b45e428f86c60736f83bbcf4662a0deb
-
SHA1
c570e0cec229a601331ff9c0d9c302bba0d85af7
-
SHA256
b07907ce3ee14b8128039ecb8e635976fc216c77035d5bf38f42ed900197c879
-
SHA512
c055978001f77d096ff95589977a316ddc7a032657a9c9027f95eccef41a8c9b72684991c19e11d3f975456dde388301af343ca8c575c8dc3641b1a9c2340182
-
SSDEEP
6144:ZjpfVIVK/SZ35l0SWLLzpSAGIyRM7wJ1wpxdMLkPiP7zo8Xq:H94KaZr0sTLJ1wJo7q
Static task
static1
Behavioral task
behavioral1
Sample
b07907ce3ee14b8128039ecb8e635976fc216c77035d5bf38f42ed900197c879exe.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
b07907ce3ee14b8128039ecb8e635976fc216c77035d5bf38f42ed900197c879exe.exe
Resource
win10v2004-20231127-en
Malware Config
Extracted
remcos
RemoteHost
172.93.217.218:2404
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-JPBJZ5
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
-
Target
b07907ce3ee14b8128039ecb8e635976fc216c77035d5bf38f42ed900197c879exe.exe
-
Size
326KB
-
MD5
b45e428f86c60736f83bbcf4662a0deb
-
SHA1
c570e0cec229a601331ff9c0d9c302bba0d85af7
-
SHA256
b07907ce3ee14b8128039ecb8e635976fc216c77035d5bf38f42ed900197c879
-
SHA512
c055978001f77d096ff95589977a316ddc7a032657a9c9027f95eccef41a8c9b72684991c19e11d3f975456dde388301af343ca8c575c8dc3641b1a9c2340182
-
SSDEEP
6144:ZjpfVIVK/SZ35l0SWLLzpSAGIyRM7wJ1wpxdMLkPiP7zo8Xq:H94KaZr0sTLJ1wJo7q
Score10/10-
NirSoft MailPassView
Password recovery tool for various email clients
-
NirSoft WebBrowserPassView
Password recovery tool for various web browsers
-
Nirsoft
-
Loads dropped DLL
-
Accesses Microsoft Outlook accounts
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-