General
-
Target
676223b89c84ef5893dc5828a91e8b833878659a2c697c086714ecc21f35c740
-
Size
265KB
-
Sample
240417-qf6hnsgh28
-
MD5
7649bfb797a7a6ba67e8744f045be121
-
SHA1
2326ba87d38928c7ef76e35e2ecdf4532c5ef09d
-
SHA256
676223b89c84ef5893dc5828a91e8b833878659a2c697c086714ecc21f35c740
-
SHA512
cae4e222a482695ad3b0c7dd1880444b5f2121d3d11a693420ac1bc4c529c3678e26aa475c0836c237b56fad7bba76d83e2b50b3d2a14978105971c376cd15cf
-
SSDEEP
6144:FKpfBDDujGArY7x5sa902poCqUwupQPrE37W6phYoIdXNEt:FKsacEx5L0C2LaQT6VIdXqt
Behavioral task
behavioral1
Sample
03ba551339062106448ff58cbc393338483439513ec8439497bf47153e13f4b7.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
03ba551339062106448ff58cbc393338483439513ec8439497bf47153e13f4b7.exe
Resource
win10v2004-20240412-en
Malware Config
Extracted
remcos
Remote
leetboy.dynuddns.net:1998
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
svcs.exe
-
copy_folder
microsofts
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
true
-
install_flag
true
-
install_path
%AppData%
-
keylog_crypt
true
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
logsa
-
mouse_option
false
-
mutex
Rmc-3XK1S0
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
-
Target
03ba551339062106448ff58cbc393338483439513ec8439497bf47153e13f4b7.exe
-
Size
483KB
-
MD5
06f5b8dffc6c138828adbc7f29cfc7f0
-
SHA1
b59ef5d613a1e49c7034c3ee05780ce054ca0054
-
SHA256
03ba551339062106448ff58cbc393338483439513ec8439497bf47153e13f4b7
-
SHA512
e706a0b3b1981cac8ddcf81482b306b4538fbfbf5c332f2b484f8c503b66d73cd09ffaab0515ecb2063d1e4a27dc30a662cc0be4f5287d2982cfbb47c7dad893
-
SSDEEP
6144:aXIktXfM8Lv86r9uVWAa2je4Z5zl4hgDHQQs4NTQjoHFsAOZZDAXYcNx5Gv:aX7tPMK8ctGe4Dzl4h2QnuPs/ZDIcv
Score10/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-