General
-
Target
c6449ba1f7980ee797f22e465cd500ea
-
Size
456KB
-
MD5
c6449ba1f7980ee797f22e465cd500ea
-
SHA1
714d9f1eded0218d97ee5eab78df4030d930d2ba
-
SHA256
6f759009cf1f7b1034790023bf59048f24e387cbeb906825015c76dd5e53ac96
-
SHA512
e658980fd853b6e8aebbe99f1825a99b0ce5bf4809f9ff6a67ec92da7ff717b93e04a4c6596d41f15675095dcfe476ab5adf5d6f66bb6b8b0d44bb7547cef708
-
SSDEEP
6144:0c53ezqVrhiBZ84M/k22nZcrTEfCNV0cjd2shWR5dBTAOZZ8jXCSrcDzku:P53ez1HzMc2k0EKNV5dlEf/Z8eSXu
Score
10/10
Malware Config
Extracted
Family
remcos
Version
3.1.5 Pro
Botnet
RemoteHost
C2
192.168.43.189:6666
Attributes
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
true
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Remcos-UOZ3LQ
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
notepad;solitaire;
Signatures
-
Remcos family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
c6449ba1f7980ee797f22e465cd500ea
409f5d6d64eccf1b9873a7c796c3f1ad
Headers
Imports
Sections