General
-
Target
58dc1cfd317058134777f77f86f62592
-
Size
456KB
-
MD5
58dc1cfd317058134777f77f86f62592
-
SHA1
22f19ee32e81d180be5c4e824d359456df811293
-
SHA256
12a0e61c40e9664cd768c55b50d204e038067e9dfa34c04d0170426565eb2d2c
-
SHA512
0d6984b84336c189eb590ae870b5a50ca81f3d90a7fe97ffdbfab9569b841711475054d6c1ea6e592ad9ae45e14ff70efcfd7c10effb865843a5e79b9a4be0c2
-
SSDEEP
6144:cc53ezqVrhiBZ84M/k22nZcrTEfCNV0cjd2shWR5dhTAOZZ8jXCSrcDCu:n53ez1HzMc2k0EKNV5dlE//Z8eStu
Score
10/10
Malware Config
Extracted
Family
remcos
Version
3.1.5 Pro
Botnet
Gold
C2
fosterpapi.dvrlists.com:9122
Attributes
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Gold-046A6R
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
notepad;solitaire;
Signatures
-
Remcos family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
58dc1cfd317058134777f77f86f62592
409f5d6d64eccf1b9873a7c796c3f1ad
Headers
Imports
Sections