General
-
Target
03ba551339062106448ff58cbc393338483439513ec8439497bf47153e13f4b7.zip
-
Size
265KB
-
Sample
240402-lz5m9sea57
-
MD5
7ec4978871a14a4f368741b8e996459e
-
SHA1
e6d2a49acebf33433d34321cd61ec959c4e91f59
-
SHA256
e5f662cfb991bb883da1cd920b511f4f2d7556c9b1a4e072b74c19457940547e
-
SHA512
4f31df9b93c32f0056b8fa805e22765b7d22b387b0fdefc986b01596eaf43c1e1afa43242d08c2f9fe3cd8c4346f9de959ee8d40387a52ceac06713fbcf19359
-
SSDEEP
6144:jiLRrUIDd+FXAuM5m4wg2Fj/UdjElTfGg6UIw:jOz+5AuM5m4l2tU+TGlw
Behavioral task
behavioral1
Sample
03ba551339062106448ff58cbc393338483439513ec8439497bf47153e13f4b7.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
03ba551339062106448ff58cbc393338483439513ec8439497bf47153e13f4b7.exe
Resource
win10v2004-20240319-en
Malware Config
Extracted
remcos
Remote
leetboy.dynuddns.net:1998
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
svcs.exe
-
copy_folder
microsofts
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
true
-
install_flag
true
-
install_path
%AppData%
-
keylog_crypt
true
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
logsa
-
mouse_option
false
-
mutex
Rmc-3XK1S0
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
-
Target
03ba551339062106448ff58cbc393338483439513ec8439497bf47153e13f4b7.exe
-
Size
483KB
-
MD5
06f5b8dffc6c138828adbc7f29cfc7f0
-
SHA1
b59ef5d613a1e49c7034c3ee05780ce054ca0054
-
SHA256
03ba551339062106448ff58cbc393338483439513ec8439497bf47153e13f4b7
-
SHA512
e706a0b3b1981cac8ddcf81482b306b4538fbfbf5c332f2b484f8c503b66d73cd09ffaab0515ecb2063d1e4a27dc30a662cc0be4f5287d2982cfbb47c7dad893
-
SSDEEP
6144:aXIktXfM8Lv86r9uVWAa2je4Z5zl4hgDHQQs4NTQjoHFsAOZZDAXYcNx5Gv:aX7tPMK8ctGe4Dzl4h2QnuPs/ZDIcv
Score10/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-