General
-
Target
G9876545678009876.XZ.zip
-
Size
681KB
-
Sample
231208-lq3gjsad76
-
MD5
d98d1ac86525405d02b9c39f0b82b383
-
SHA1
4ed7435378524fb805c603b2b796fcc561d61911
-
SHA256
73cd192a1e2293fe540169fa1d0367699b00a6a005d9a913a48d0ef65cca64d0
-
SHA512
1d703a97390239e3b4efb4f3469d990bbb6fa661a0a65877b78e09c0028f09a7bb6ff46f09baa11b73f006b5c6033cd2c5e114946784f8a60323fa0885a1f4a8
-
SSDEEP
12288:jHvwZlKw22IArleQg6N5xdyUAe8tglyO/nHR1GyZGxZgDbtvOKSDWf:LqKs5DL/r3xAyZ+QOKn
Static task
static1
Behavioral task
behavioral1
Sample
G9876545678009876.exe
Resource
win7-20231201-en
Behavioral task
behavioral2
Sample
G9876545678009876.exe
Resource
win10v2004-20231130-en
Malware Config
Extracted
remcos
RemoteHost
107.175.229.139:8087
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-IZFV1M
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
-
Target
G9876545678009876.BAT
-
Size
757KB
-
MD5
6696d37cf0b9b65fd9fc58934d79c9cb
-
SHA1
6c75525f455c341e936ec64546fc4d9bfe52ee81
-
SHA256
2db991b9ae725ec59f9a29654e4c5f8d2bf363662cfa8d271a8692fea4883744
-
SHA512
b9db5f1832b7a6d046c029204d6061e13b1e4b1d3e1a0117a7f51d03aa08b6a5f97be2036cba93ceb17a4f558c4ddfd580a80185d9c8446818b854ebe1749a18
-
SSDEEP
12288:HDWMD9ehE+uDneLBQt20dup/20AQBOLdxD4N1fahKDZncwk6pvxT0K0jlyOJN9R4:FeVZ27zZPdnjImBOQXU
Score10/10-
NirSoft MailPassView
Password recovery tool for various email clients
-
NirSoft WebBrowserPassView
Password recovery tool for various web browsers
-
Nirsoft
-
Drops startup file
-
Accesses Microsoft Outlook accounts
-
Suspicious use of SetThreadContext
-