General
-
Target
8c71aeb54732d7c292c42820b9b46cd44710c58920bdee797c8c462b22c3569b.exe
-
Size
483KB
-
MD5
190c8a74c90c521538394ae53b8408fb
-
SHA1
781682ec6cafa1ab91b1f671c9549275c8b1e2fe
-
SHA256
edba5eb55e82d4b5db35bdaf2e2c3bca1cf01c2f37c74faf94b0ed0c2a591f03
-
SHA512
6f6365cf503e91c4eaac93c3f370c52fde868afb411b30e310ef560e92a029a536fe754dd4e1780dd34a7f5854d707f6e3d1efefe1d1433f77b65713f4eeeec9
-
SSDEEP
6144:x/7iPrcL3ArwhBq7Kjsn9iHGXg0lwGS9MNNhdFvPxps9gsAOZZuAXn4D:x/uPq3AfK496Gw0lwGXN3pvs/Zu
Score
10/10
Malware Config
Extracted
Family
remcos
Botnet
money
C2
salwanazeeze.duckdns.org:9595
salwanazeeze.ddns.net:9595
Attributes
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-5ZS6TO
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 1 IoCs
-
Remcos family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
8c71aeb54732d7c292c42820b9b46cd44710c58920bdee797c8c462b22c3569b.exe
Headers
Sections