General
-
Target
665529172f4fb478a8c91019a5086e3d0d776a628b7fe0c0e5453aa580921171
-
Size
890KB
-
Sample
240417-r8efbsed3y
-
MD5
81c7e32e43cb079daaa9565e7182efb4
-
SHA1
f9bcc878fbaa333ae7bcd024c516e23ea8b19439
-
SHA256
665529172f4fb478a8c91019a5086e3d0d776a628b7fe0c0e5453aa580921171
-
SHA512
369a24dcc6dc46775d3292fc32b2472a324f1e79c4ba0d78f90fcdcb01f9fadd98f476cac2f85239c82573abbb0bfc4ff2d3ba9006386a214cca22bdf898796e
-
SSDEEP
24576:RsZ5RXER9btaOEPhIddblOOHjPb3QqGoq1X1T:RsZ5JAtaOEPOPPH/Lq1X1
Static task
static1
Behavioral task
behavioral1
Sample
6fcb2b9e055ed80a6cd600c7c211d8c2d9dcaa959fdf525dd02ac0685a4d6827.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6fcb2b9e055ed80a6cd600c7c211d8c2d9dcaa959fdf525dd02ac0685a4d6827.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
remcos
RemoteHost
104.250.180.178:7902
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
Skyreal.exe
-
copy_folder
Skyreal
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
true
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Sky-K7LT69
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
-
Target
6fcb2b9e055ed80a6cd600c7c211d8c2d9dcaa959fdf525dd02ac0685a4d6827.exe
-
Size
934KB
-
MD5
7cdb1da63c9ff18665e4a85fec748fcd
-
SHA1
fa49423cb84debb5c378d89c88781c286f4f8e56
-
SHA256
6fcb2b9e055ed80a6cd600c7c211d8c2d9dcaa959fdf525dd02ac0685a4d6827
-
SHA512
3ea3fca56456711eb1095f525be927ce4fa3cbdd68fa668078ba543799dc00e0d806d7291986a321303eb395a446c38898574e57d6fc44b18961c08903c68a58
-
SSDEEP
12288:9J5Qyg1q3ZzWW1O5tmOy4nY9LIvpTo+CmqLvRDVlR9VAqF63hvWCndZl6lXDj:PGyuqAEVApTImalR9WFhuCdTy3
Score10/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-