General
-
Target
SecuriteInfo.com.Win32.PWSX-gen.12553.4077.exe
-
Size
888KB
-
Sample
240402-v8vzvsgf8s
-
MD5
215dc8f3f75f1d67d9b6fcec09cb4d00
-
SHA1
b78ba4e1350b1173b1a2457209993f439fa7e199
-
SHA256
2e368631139e75aa6cce30aef3ccdfe59dc2131a7f5166fa5b0e36c969eb5ada
-
SHA512
2a094dd055eedbe761e7da1b7eb44e1a4da04eb79a44bbb7b003a6bc31dadd90deb9cee2e101e55dfba72a700681557cc032547e8bea40f6c0bec2fd418e2ede
-
SSDEEP
24576:R6SNOGucnCSGYVWX54fKQ7ov6pASCDvHKfpket/0Ms20:kyOPE4WoTQa6pA97HqeeC
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Win32.PWSX-gen.12553.4077.exe
Resource
win7-20240220-en
Malware Config
Extracted
remcos
BUDDY
192.210.201.57:52499
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-LMLI87
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
-
Target
SecuriteInfo.com.Win32.PWSX-gen.12553.4077.exe
-
Size
888KB
-
MD5
215dc8f3f75f1d67d9b6fcec09cb4d00
-
SHA1
b78ba4e1350b1173b1a2457209993f439fa7e199
-
SHA256
2e368631139e75aa6cce30aef3ccdfe59dc2131a7f5166fa5b0e36c969eb5ada
-
SHA512
2a094dd055eedbe761e7da1b7eb44e1a4da04eb79a44bbb7b003a6bc31dadd90deb9cee2e101e55dfba72a700681557cc032547e8bea40f6c0bec2fd418e2ede
-
SSDEEP
24576:R6SNOGucnCSGYVWX54fKQ7ov6pASCDvHKfpket/0Ms20:kyOPE4WoTQa6pA97HqeeC
-
NirSoft MailPassView
Password recovery tool for various email clients
-
NirSoft WebBrowserPassView
Password recovery tool for various web browsers
-
Nirsoft
-
Accesses Microsoft Outlook accounts
-
Suspicious use of SetThreadContext
-