General
-
Target
70c8fedbf07a7df7a906550d60dfec0f49f47ee0d7033c06838fada96aa22996
-
Size
265KB
-
Sample
240417-qdexyagf79
-
MD5
8205afe4c13d2950c08974d0a15bb826
-
SHA1
caa04317c9da14dacc9d3a016b390731bb37c92d
-
SHA256
70c8fedbf07a7df7a906550d60dfec0f49f47ee0d7033c06838fada96aa22996
-
SHA512
e14992663fd346bc114901ce397f45ebf8c5bd3a7d78e6468911e895110d063277b2be3dbaf3112fbdaeb00c8b241b49c8e301cf8ebfdd2afec6eb5253845ed1
-
SSDEEP
6144:JASK3G6aB/enzfD20bQsJWCVvR4oni0rHyL49e:J2WrB/enzff92oniGHkWe
Behavioral task
behavioral1
Sample
03ba551339062106448ff58cbc393338483439513ec8439497bf47153e13f4b7.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
03ba551339062106448ff58cbc393338483439513ec8439497bf47153e13f4b7.exe
Resource
win10v2004-20240412-en
Malware Config
Extracted
remcos
Remote
leetboy.dynuddns.net:1998
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
svcs.exe
-
copy_folder
microsofts
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
true
-
install_flag
true
-
install_path
%AppData%
-
keylog_crypt
true
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
logsa
-
mouse_option
false
-
mutex
Rmc-3XK1S0
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
-
Target
03ba551339062106448ff58cbc393338483439513ec8439497bf47153e13f4b7.exe
-
Size
483KB
-
MD5
06f5b8dffc6c138828adbc7f29cfc7f0
-
SHA1
b59ef5d613a1e49c7034c3ee05780ce054ca0054
-
SHA256
03ba551339062106448ff58cbc393338483439513ec8439497bf47153e13f4b7
-
SHA512
e706a0b3b1981cac8ddcf81482b306b4538fbfbf5c332f2b484f8c503b66d73cd09ffaab0515ecb2063d1e4a27dc30a662cc0be4f5287d2982cfbb47c7dad893
-
SSDEEP
6144:aXIktXfM8Lv86r9uVWAa2je4Z5zl4hgDHQQs4NTQjoHFsAOZZDAXYcNx5Gv:aX7tPMK8ctGe4Dzl4h2QnuPs/ZDIcv
Score10/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-