General
-
Target
5755305654c07b239c370661598bc698f8113b41fe5785e0e13098a66cdbd4eb.zip
-
Size
886KB
-
Sample
240402-lz664ade8y
-
MD5
65b1e83966033f64f02f566b24761ab9
-
SHA1
a79cdc00bfc06e1fed94223f54325513fb937752
-
SHA256
c82b6fc08bcfa1d30118384b13965df8a3136f5143680a25f7c49abefd260f24
-
SHA512
4e993caa49f72c072bae609222d762d4141d39668d97578496ee9d7a68bdba833358664f3ade6411589c39371cd711f8f37870e51fd5783eff99d9a3e51e7a6f
-
SSDEEP
24576:btokp5y7CFEj883pU1MDJnuRFCQvZxJr+AKpSY:5okp54kEj8KbDJnuHCQhxJyl
Static task
static1
Behavioral task
behavioral1
Sample
5755305654c07b239c370661598bc698f8113b41fe5785e0e13098a66cdbd4eb.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
5755305654c07b239c370661598bc698f8113b41fe5785e0e13098a66cdbd4eb.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
remcos
RemoteHost
194.147.140.180:1987
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-FRNTO2
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
-
Target
5755305654c07b239c370661598bc698f8113b41fe5785e0e13098a66cdbd4eb.exe
-
Size
998KB
-
MD5
9a942028f55f59560c38677923c7ce6a
-
SHA1
069cf2b7306f61ac65a4598f519a83dd535325c9
-
SHA256
5755305654c07b239c370661598bc698f8113b41fe5785e0e13098a66cdbd4eb
-
SHA512
e3f0f2d9d97cfa7178d3fd1e12cd35c9b1a5b08e92767389bcf998e428e08e4527fa7b9204941e849a6f28c240c52c57b653777e7620210c5d024dbce0a22eda
-
SSDEEP
24576:yxWTl+NDnZjbBxcxyGFKjL8kFzzjBh3HrYMY:lpknZHEyGw3t3cz
Score10/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-