General
-
Target
envifa.vbs
-
Size
151KB
-
Sample
231213-mxhw6achg4
-
MD5
64782d163bcd2fbbbf72bf768a4b57a4
-
SHA1
9feca15cae48fb30fc12cc241243e5294cf3b79f
-
SHA256
0bede06c4b670f1dff945866768c643ece0db8618cf042ffeeda9d88aad09880
-
SHA512
7c7b0c74fff9b480fd61b80903b8a8ed9a1124229e0922e286eb82146b630ecb95cc6b80fb24c72d72eed978dc1f6998e1d4f01f7806137b153692db17d0e033
-
SSDEEP
1536:sp9p9p9p9p9p9p9pu20WwCqPv3+NhlV9p9p9p9p9p9p9p9p5MTp9p9p9p9p9p9pL:d
Static task
static1
Behavioral task
behavioral1
Sample
envifa.vbs
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
envifa.vbs
Resource
win10v2004-20231127-en
Malware Config
Extracted
https://uploaddeimagens.com.br/images/004/686/431/original/dll_vbe.jpg?1702073941
https://uploaddeimagens.com.br/images/004/686/431/original/dll_vbe.jpg?1702073941
Extracted
remcos
RemoteHost
remccoss2023.duckdns.org:4576
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
registros.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-E5ZBB0
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Capturas de pantalla
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
-
Target
envifa.vbs
-
Size
151KB
-
MD5
64782d163bcd2fbbbf72bf768a4b57a4
-
SHA1
9feca15cae48fb30fc12cc241243e5294cf3b79f
-
SHA256
0bede06c4b670f1dff945866768c643ece0db8618cf042ffeeda9d88aad09880
-
SHA512
7c7b0c74fff9b480fd61b80903b8a8ed9a1124229e0922e286eb82146b630ecb95cc6b80fb24c72d72eed978dc1f6998e1d4f01f7806137b153692db17d0e033
-
SSDEEP
1536:sp9p9p9p9p9p9p9pu20WwCqPv3+NhlV9p9p9p9p9p9p9p9p5MTp9p9p9p9p9p9pL:d
Score10/10-
Blocklisted process makes network request
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-