General
-
Target
clientfmUx.exe
-
Size
516KB
-
Sample
231206-pr5j3sdb3s
-
MD5
38a9b7e6b93904b572e76cad2f99353c
-
SHA1
20bd0ea13cbc76cdbb9d002a457e543d02e9d500
-
SHA256
06b9b10a15c0b2856620dd4469c8a976bfbc42e506747a04a763dbeeaf1ecb79
-
SHA512
b381687ef7f9f32af5b254b33bfffc287f675ba06d990df011a460c4f76c81d76546203af6bf0fc412e328d5e013e3997db56b3454002edc71ab6357e4211683
-
SSDEEP
12288:1oPHzIcgTRo9RvHBQAC76LUkd0bpaMwdHqUz:SPHM1ohP0XAx
Static task
static1
Behavioral task
behavioral1
Sample
clientfmUx.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
clientfmUx.exe
Resource
win10v2004-20231127-en
Malware Config
Extracted
remcos
RemoteHost
retghrtgwtrgtg.bounceme.net:3839
listpoints.click:7020
datastream.myvnc.com:5225
gservicese.com:2718
center.onthewifi.com:8118
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
explorer.exe
-
delete_file
false
-
hide_file
true
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-OPX7KW
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
-
Target
clientfmUx.exe
-
Size
516KB
-
MD5
38a9b7e6b93904b572e76cad2f99353c
-
SHA1
20bd0ea13cbc76cdbb9d002a457e543d02e9d500
-
SHA256
06b9b10a15c0b2856620dd4469c8a976bfbc42e506747a04a763dbeeaf1ecb79
-
SHA512
b381687ef7f9f32af5b254b33bfffc287f675ba06d990df011a460c4f76c81d76546203af6bf0fc412e328d5e013e3997db56b3454002edc71ab6357e4211683
-
SSDEEP
12288:1oPHzIcgTRo9RvHBQAC76LUkd0bpaMwdHqUz:SPHM1ohP0XAx
Score10/10-
Suspicious use of SetThreadContext
-