General
-
Target
Invoice_891979.exe
-
Size
1.0MB
-
Sample
231213-njvjgabher
-
MD5
e05fb8774765ed36cf42c340e52e23da
-
SHA1
703d9908a0b2784ba6e8875bfb010d52e19b4ef0
-
SHA256
61ab894e68dcc97a0625f69f6f70305a57d653f9cad34b9ed2c3d206b9a345c3
-
SHA512
6f0a5814983554339c899c19ee9e705b2a48c9aa31403e477301e52518eb518336ad8ce8be03a971909c1717ac630c8667a10d59f1ff6f1cc9175797a6c8b3e6
-
SSDEEP
24576:UJJAAZhc5ff9bNSNLvn6x1ohhERWY+YQnIHNc:qnZSF8NbONRN+YQ
Static task
static1
Behavioral task
behavioral1
Sample
Invoice_891979.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
Invoice_891979.exe
Resource
win10v2004-20231127-en
Malware Config
Extracted
remcos
RemoteHost
jburg.net:3363
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-Y4B0AA
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
-
Target
Invoice_891979.exe
-
Size
1.0MB
-
MD5
e05fb8774765ed36cf42c340e52e23da
-
SHA1
703d9908a0b2784ba6e8875bfb010d52e19b4ef0
-
SHA256
61ab894e68dcc97a0625f69f6f70305a57d653f9cad34b9ed2c3d206b9a345c3
-
SHA512
6f0a5814983554339c899c19ee9e705b2a48c9aa31403e477301e52518eb518336ad8ce8be03a971909c1717ac630c8667a10d59f1ff6f1cc9175797a6c8b3e6
-
SSDEEP
24576:UJJAAZhc5ff9bNSNLvn6x1ohhERWY+YQnIHNc:qnZSF8NbONRN+YQ
Score10/10-
Detect ZGRat V1
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-