Overview

overview

10

Static

static

10

1710341284...ed.exe

windows7-x64

1

1710341284...ed.exe

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    1710341284e1bfa5e5b62d550c8ff21fd50f577a1f0ea1242b88e38818ea5ce4c220900d37979.dat-decoded.exe

  • Size

    483KB

  • MD5

    df9b5001960054468482c03aa883de7f

  • SHA1

    ecc83ba0a038a495f225e3bc2a88c93a502f58a9

  • SHA256

    badd735f2a94895813fdfdc04c50e2889ab1dca6c12faa65223c758bf8a1edd3

  • SHA512

    3f9ae95a5e30eed36e64efc618b1ca6f04c8309be982a7ebc1044fd8c0b39e9af85310575a5f2ba5a5c5570e48fbe092c0cda6e3f222f64b14bbd35d5f9f8511

  • SSDEEP

    6144:8XIktXfM8Lv86r9uVWAa2je4Z5zl4hgDHQQs4NTQjoHFsAOZZsAX4cNj5Gv:8X7tPMK8ctGe4Dzl4h2QnuPs/ZsKcv

Score
10/10
acopladoremcos

Malware Config

Extracted

Family

remcos

Botnet

Acoplado

C2

novomrcos.duckdns.org:24041

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    xte

  • mouse_option

    false

  • mutex

    RmcM-A05ORH

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos family
    remcos
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 1710341284e1bfa5e5b62d550c8ff21fd50f577a1f0ea1242b88e38818ea5ce4c220900d37979.dat-decoded.exe
    .exe windows:5 windows x86 arch:x86

    8d5087ff5de35c3fbb9f212b47d63cad


    Headers

    Imports

    Sections