Overview

overview

10

Static

static

10

c322d551fe...c1.exe

windows7-x64

10

c322d551fe...c1.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c322d551fe9fbd816dbfcdb273ead2c91045982721dd8cf540b51394dfee62c1.exe

  • Size

    481KB

  • MD5

    f16394e4d103ec3327492188202d0c61

  • SHA1

    2a3db7b4d5ba304384ff7cede3f8f3ddb7e50b0c

  • SHA256

    128f1c108c33301cdbac6b21ada9af778a52e37fd04a70e43fcad276749da97a

  • SHA512

    c499883b70f5028387fb4eb92882c203a8e8a69551cd8cd5cc5b6bbf207bc1e5c5695b7a6fcd9f56a86b1dcc8991ba01aa1040801d861cdc47e831015e9694a5

  • SSDEEP

    12288:HRXxReZj3WZfj/2eSseWFaIe2+f8CL47bs/ZfW:Hx7cyF2eSsewS8W47eZO

Score
10/10
ethremcos

Malware Config

Extracted

Family

remcos

Botnet

ETH

C2

zoonm.ddns.net:33871

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    vlc.exe

  • copy_folder

    vlc

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-KDOQDL

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 1 IoCs
  • Remcos family
    remcos
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • c322d551fe9fbd816dbfcdb273ead2c91045982721dd8cf540b51394dfee62c1.exe
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections