General
-
Target
ungziped_file.exe
-
Size
2.0MB
-
Sample
240118-kv26xaghe4
-
MD5
a478422522067fbb67b31099db6668bc
-
SHA1
749000fbedbc419986a84bd437a5d53c84bd24e6
-
SHA256
e60532b82799103e53b59fa601e202ede08fe446bd4e7cbf47e5fcbdd332ccc9
-
SHA512
6f3eddad74ef3ae864c242fc5176a8dbaeb18da09aa1ba9143b96bc89da807c005e1fc25207a9907b91b5cf54275ffb5c5e78a362f6b422e9e1ee2ee049534eb
-
SSDEEP
24576:bir4EZvZ42XYhAejzefbIWw6BtKjUq4J2Q+2RitBiuHoXMEb8rJ9Mgfmvj9:0W2XiHjzefbSQAPcuIY4mmb9
Static task
static1
Behavioral task
behavioral1
Sample
ungziped_file.exe
Resource
win7-20231129-en
Malware Config
Extracted
remcos
24
162.218.122.24:5707
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-A49MY7
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
-
Target
ungziped_file.exe
-
Size
2.0MB
-
MD5
a478422522067fbb67b31099db6668bc
-
SHA1
749000fbedbc419986a84bd437a5d53c84bd24e6
-
SHA256
e60532b82799103e53b59fa601e202ede08fe446bd4e7cbf47e5fcbdd332ccc9
-
SHA512
6f3eddad74ef3ae864c242fc5176a8dbaeb18da09aa1ba9143b96bc89da807c005e1fc25207a9907b91b5cf54275ffb5c5e78a362f6b422e9e1ee2ee049534eb
-
SSDEEP
24576:bir4EZvZ42XYhAejzefbIWw6BtKjUq4J2Q+2RitBiuHoXMEb8rJ9Mgfmvj9:0W2XiHjzefbSQAPcuIY4mmb9
-
Detect ZGRat V1
-
NirSoft MailPassView
Password recovery tool for various email clients
-
NirSoft WebBrowserPassView
Password recovery tool for various web browsers
-
Nirsoft
-
Accesses Microsoft Outlook accounts
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-