General
-
Target
rZD-25-05-02-Soto.bat
-
Size
960KB
-
Sample
240206-y9ssnsfdh5
-
MD5
22d8cb9eff064846c4d9d10c405d899a
-
SHA1
40868d348bf6480d6cf3b4b1cc8ecb66f16b48f8
-
SHA256
71c691a6f747c96dac3ed26194a58123b8200be734dae7bbbf0ade19863d737f
-
SHA512
c975c70c4b365b82b6a1390885e6e8e03418cf98ade2c13bf7c2235c655083d8d7105bd0fbb277eff1c65f58dd287bbdefa12ebb1a56af94d6520846ac85e763
-
SSDEEP
24576:A+avBXTCVnsXjgYPioSAaowCNtn8aJ4B/F3YdgDmIcn:TavBXTptSLowOa19Ydkcn
Static task
static1
Behavioral task
behavioral1
Sample
rZD-25-05-02-Soto.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
rZD-25-05-02-Soto.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20231222-en
Malware Config
Extracted
remcos
24
162.218.122.24:5707
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-A49MY7
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
-
Target
rZD-25-05-02-Soto.bat
-
Size
960KB
-
MD5
22d8cb9eff064846c4d9d10c405d899a
-
SHA1
40868d348bf6480d6cf3b4b1cc8ecb66f16b48f8
-
SHA256
71c691a6f747c96dac3ed26194a58123b8200be734dae7bbbf0ade19863d737f
-
SHA512
c975c70c4b365b82b6a1390885e6e8e03418cf98ade2c13bf7c2235c655083d8d7105bd0fbb277eff1c65f58dd287bbdefa12ebb1a56af94d6520846ac85e763
-
SSDEEP
24576:A+avBXTCVnsXjgYPioSAaowCNtn8aJ4B/F3YdgDmIcn:TavBXTptSLowOa19Ydkcn
Score10/10-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-
-
-
Target
$PLUGINSDIR/System.dll
-
Size
12KB
-
MD5
0d7ad4f45dc6f5aa87f606d0331c6901
-
SHA1
48df0911f0484cbe2a8cdd5362140b63c41ee457
-
SHA256
3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
-
SHA512
c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
-
SSDEEP
192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
Score3/10 -