Overview

overview

10

Static

static

10

0af76f2897...d5.exe

windows7-x64

1

0af76f2897...d5.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f6118a965e44ee55e708edf7adcdc1df.bin

  • Size

    266KB

  • MD5

    feb689612761c633b7af967eb31a16d9

  • SHA1

    45f82c2640bf9670362ca2c70cc1b022a6be300d

  • SHA256

    a1c5ebc29539b192d311dfab0acc75d53d3f151b25e52e7b59c7ff7131df8695

  • SHA512

    cc6ca5d24584f68360ab1e87e292d77e04835f6eddf28cf487c40eb53185a7fea53a611563f75ead01ea9d39d7b03b3711f7172db3fd86cb6e690b2aa65a6d48

  • SSDEEP

    6144:WHNyryUAlakXaZBzqVC39Vz5elUi4m0qpa0msKuSUfywK:/r+la+aqVCNVzQP4Z0wUjK

Score
10/10
zynovaremcos

Malware Config

Extracted

Family

remcos

Botnet

ZYNOVA

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    true

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    lpaowtrts.dat

  • keylog_flag

    false

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    akpleoeurs-QPYUMO

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos family
    remcos
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • f6118a965e44ee55e708edf7adcdc1df.bin
    .zip

    Password: infected

  • 0af76f2897158bf752b5ee258053215a6de198e8910458c02282c2d4d284add5.exe
    .exe windows:5 windows x86 arch:x86

    Password: infected

    8d5087ff5de35c3fbb9f212b47d63cad


    Headers

    Imports

    Sections