General
-
Target
FACTURA090000.zIP
-
Size
951KB
-
Sample
231206-re5enade5s
-
MD5
9fa41f651d54a2b8a1617ee233a7ebfc
-
SHA1
a8e12334e5acf2030a146f9b26a4f79ea45654df
-
SHA256
eaac1b1dda1328d09641300b4eeba319d467f58b7b01214d70ea41ce4ddad3fd
-
SHA512
512384218e07c60868a780a41d6a5d83fa9b80a133ba00f5ec3d320ccc2328f1c1068b786796345028c3d5c0f6f2821c21ba25042c6e8004b4ef6692e03142d2
-
SSDEEP
24576:AbBlTV4ny+oBwYycnCasIluEEKRn/XBcUIBvlE1y:oBlT+njoBlnSIERO/2vBvaU
Static task
static1
Behavioral task
behavioral1
Sample
FACTURA090000.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
FACTURA090000.exe
Resource
win10v2004-20231130-en
Malware Config
Extracted
remcos
RemoteHost
107.175.229.139:8087
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-IZFV1M
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
-
Target
FACTURA090000.BAT
-
Size
989KB
-
MD5
f5029b4aa3e668aa60d5c3e52a2fbfe7
-
SHA1
0130efa0cdf8baf5b25a41888a461aaa3bbb254a
-
SHA256
a61cdf67459e5b97f33747c8a251b9112e402fa11eeac22c2aefe811af9508b5
-
SHA512
5efbf0c8af8d267266ee8465888075e13e2631de3638273b8df6f3a9db0ca0d68e1cec1350c9fe62ab34397995b94d9756c20dbff5ae372c7e854a7ea131aa92
-
SSDEEP
24576:X/uGGqtConVu2cpGa0I50EI2Rb/vBKjahiCcocFO:X/uGGwnSpSIGRi/Qjahc4
Score10/10-
NirSoft MailPassView
Password recovery tool for various email clients
-
NirSoft WebBrowserPassView
Password recovery tool for various web browsers
-
Nirsoft
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook accounts
-
Suspicious use of SetThreadContext
-