Overview

overview

10

Static

static

10

bb65b08e05...01.exe

windows7-x64

1

bb65b08e05...01.exe

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    e6c279f15ab6c1c2b04c2eaffa1d93071b43531f39ae1b2b81e28cdf677a0a87

  • Size

    265KB

  • MD5

    fe947176cc4e4efd9efa9b7e5136a9b8

  • SHA1

    de680d8a14691f683be52b6e7f66fc255409c513

  • SHA256

    e6c279f15ab6c1c2b04c2eaffa1d93071b43531f39ae1b2b81e28cdf677a0a87

  • SHA512

    694e7abe159efed41db3d8c2a57689eca07df866a5977b0d1dab42fb973353f0fa80264ffb1de450761c72453ab2678f64e1cda22dd9b692db28e035a33be071

  • SSDEEP

    6144:YAIq8UogLWrw4CWAclDzfncChmCwDks2kxJCfmn+kAjG6PRZa6hZf2BgF:TdrJClnAUaHp2kxJCfmlA6EZhw+F

Score
10/10
freshremcos

Malware Config

Extracted

Family

remcos

Botnet

Fresh

C2

allsmt.cam:3187

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-R2F7VS

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos family
    remcos
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • e6c279f15ab6c1c2b04c2eaffa1d93071b43531f39ae1b2b81e28cdf677a0a87
    .zip

    Password: infected

  • bb65b08e05845104045d1af1bda9a798391fee515b6bf5a21cc7bd9ce2117a01.exe
    .exe windows:5 windows x86 arch:x86

    8d5087ff5de35c3fbb9f212b47d63cad


    Headers

    Imports

    Sections