General
-
Target
xw8oKxLrOnt6.exe
-
Size
483KB
-
Sample
240409-2r8mysfh35
-
MD5
c64376d815b8e57d6a9b20a97e6bd5d9
-
SHA1
e3ce3036c9fa24209ee3337dfbd668449e238788
-
SHA256
0986af462eaf8a1a2fd770259b663e0c82539764fc49f03755a0a8034e239231
-
SHA512
89f451d7703c8d8c166a702466cf17d8da38462e73e2f7a5943763c4804a44447338c241e68d194eabb4f1f4bb626adbf17229db1b7a23ff50359879d1db6d22
-
SSDEEP
6144:6XIktXfM8Lv86r9uVWAa2je4Z5zl4hgDHQQs4NTQjoHFsAOZZDAXYcNv5Gv:6X7tPMK8ctGe4Dzl4h2QnuPs/ZDqcv
Behavioral task
behavioral1
Sample
xw8oKxLrOnt6.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
xw8oKxLrOnt6.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
remcos
RemoteHost
asegurar100.4cloud.click:8888
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-I30NBE
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
-
Target
xw8oKxLrOnt6.exe
-
Size
483KB
-
MD5
c64376d815b8e57d6a9b20a97e6bd5d9
-
SHA1
e3ce3036c9fa24209ee3337dfbd668449e238788
-
SHA256
0986af462eaf8a1a2fd770259b663e0c82539764fc49f03755a0a8034e239231
-
SHA512
89f451d7703c8d8c166a702466cf17d8da38462e73e2f7a5943763c4804a44447338c241e68d194eabb4f1f4bb626adbf17229db1b7a23ff50359879d1db6d22
-
SSDEEP
6144:6XIktXfM8Lv86r9uVWAa2je4Z5zl4hgDHQQs4NTQjoHFsAOZZDAXYcNv5Gv:6X7tPMK8ctGe4Dzl4h2QnuPs/ZDqcv
Score1/10 -