Overview

overview

10

Static

static

10

d9d7b97d4f...5f.exe

windows7-x64

10

d9d7b97d4f...5f.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    d9d7b97d4f42340aeeb6ba10caae12fa8d55cf7bd74dca924c43a84cbb6dec5f.exe

  • Size

    481KB

  • MD5

    6b0ea0d2e54f8acd7563c629b4e02125

  • SHA1

    54c780c185cec71ec8f6eadcc54b87bed90e1fc4

  • SHA256

    8b1710a6fad5b588792b23e2d814e86597f01e0fa3465e48dc21cd0a33793fb0

  • SHA512

    6636185d0ef4d530ca51b241d6d34f00aee9e6e5a0ca07d28877e3ff97f1ded8138c7b8e8fb5e13b25dfc85967a14c6159c4d94263c7fa9ee296173966a86ff6

  • SSDEEP

    12288:bRXxReZj3WZfj/2eSseWFaIe2+f8CL47bs/ZfW:bx7cyF2eSsewS8W47eZO

Score
10/10
testremcos

Malware Config

Extracted

Family

remcos

Botnet

test

C2

salwanazeeze.duckdns.org:9595

salwanazeeze.ddns.net:9595
Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-8N0XYJ

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 1 IoCs
  • Remcos family
    remcos
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • d9d7b97d4f42340aeeb6ba10caae12fa8d55cf7bd74dca924c43a84cbb6dec5f.exe
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections