General
-
Target
decoded_3stage.ps1
-
Size
1023B
-
Sample
231211-mzt27seab8
-
MD5
49e37de2f7edc6ec685b974554e7f2fa
-
SHA1
a7ce3554a0c0d9e5c95bcc0f8bcd92ad18099a23
-
SHA256
52171e2ce416f16ddfc7eae063a610badf15a83da5fef831b0acd05e54906c59
-
SHA512
2ca054158129052877d8ba4bae81abd8bda8abde508ee17edaf3de304a7d584b759f40fb2605c3b3aea1380f40f9d0d7b70b04e01f83247440dc1ac91a02e019
Static task
static1
Behavioral task
behavioral1
Sample
decoded_3stage.ps1
Resource
win7-20231130-en
Behavioral task
behavioral2
Sample
decoded_3stage.ps1
Resource
win10v2004-20231201-en
Malware Config
Extracted
https://uploaddeimagens.com.br/images/004/686/431/original/dll_vbe.jpg?1702073941
https://uploaddeimagens.com.br/images/004/686/431/original/dll_vbe.jpg?1702073941
Extracted
remcos
RemoteHost
top.noforabusers1.xyz:2090
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-1IWDHQ
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
-
Target
decoded_3stage.ps1
-
Size
1023B
-
MD5
49e37de2f7edc6ec685b974554e7f2fa
-
SHA1
a7ce3554a0c0d9e5c95bcc0f8bcd92ad18099a23
-
SHA256
52171e2ce416f16ddfc7eae063a610badf15a83da5fef831b0acd05e54906c59
-
SHA512
2ca054158129052877d8ba4bae81abd8bda8abde508ee17edaf3de304a7d584b759f40fb2605c3b3aea1380f40f9d0d7b70b04e01f83247440dc1ac91a02e019
Score10/10-
Blocklisted process makes network request
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-