General

  • Target

    1701849064ac095385a07377f6231c4a5ab01f6070adb38d9da668aed499e0c987abb42523360.dat-decoded.exe

  • Size

    483KB

  • MD5

    77fc4ea7c947604fa26f6998502163aa

  • SHA1

    916c530427852da922e7c99a495819bdade9023b

  • SHA256

    769e79005f9f65cf5eecc068fd142bec12879d45aae6c6f0404a079a12ef739a

  • SHA512

    3e0e2fe4344fbb471130f7a4f57b25c8faa496a1741b90de005c0039730b390e0a2f5bbef231d4d44d80aa5b8cb870215817dcb4e7b301471da9cfe85e8c6f0a

  • SSDEEP

    6144:cXIktXfM8Lv86r9uVWAa2je4Z5zl4hgDHQQs4NTQjoHFsAOZZsAX4cN5q5Gv:cX7tPMK8ctGe4Dzl4h2QnuPs/Zskqcv

Score
10/10

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

remccoss2023.duckdns.org:4576

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    registros.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-E5ZBB0

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Capturas de pantalla

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 1701849064ac095385a07377f6231c4a5ab01f6070adb38d9da668aed499e0c987abb42523360.dat-decoded.exe
    .exe windows:5 windows x86 arch:x86

    8d5087ff5de35c3fbb9f212b47d63cad


    Headers

    Imports

    Sections