General
-
Target
SCANDOC123.RAR
-
Size
452KB
-
Sample
231211-qs7lhahcd6
-
MD5
c7235cd9142a925cd9a6a25e49695cec
-
SHA1
6c350e9113a736e95cef2f9e47a43655d65afadd
-
SHA256
c709a79d3eae6c2457ba5edf3f3d4d3b11d7d20a0f93886d8d4f63e8b3c2381b
-
SHA512
078c9e1f817d987adc365b1d3e065101bac8d7e448534f81c900587c564982188315a839058004b2071f5d551b145c5654234b663aca007a08012409f0338998
-
SSDEEP
12288:0m2/S5iZ81orEQjO+iv0hXLo4EeYVDzuB862vWYwGm:0mroyoj7UWYc
Static task
static1
Behavioral task
behavioral1
Sample
Scandoc123.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
Scandoc123.exe
Resource
win10v2004-20231130-en
Malware Config
Extracted
remcos
xxxx
mxzaa.duckdns.org:2404
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
xxxx
-
mouse_option
false
-
mutex
Rmc-VSXS6U
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
-
Target
Scandoc123.exe
-
Size
1.0MB
-
MD5
0ad448aa3eeb1ebc44ec5f82fc9168e6
-
SHA1
91673869379d999d6c54b04bcbf6665ccc408ea6
-
SHA256
2673cb78d77db954842c1311a9ecbef666bbf15b0b0058585c4d00f38cf3f225
-
SHA512
a7da070672ff6a45496409fdf0a872fc2c5d41755c837532cf07b25d00320a02d9f3c7c5277fd84dbc94610527d703284e0b613f44ea6373c75c1adde76042b9
-
SSDEEP
24576:0it4uJtHL/PkgSAq5dRHBez6oONXEef2sS5O2Yi:0iWiH7P85fsz6oM2m2/
Score10/10-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-