General
-
Target
08365ea5cacae1f793983fcd1049bd02d920c1dd6b5414ffe249de0c3778311d
-
Size
862KB
-
Sample
240417-rqs6rsdc2y
-
MD5
c78d0ef40aee6d2c5ec0b24c91e5bab3
-
SHA1
780c0a463b04244761804d36e1d6116c81bbc205
-
SHA256
08365ea5cacae1f793983fcd1049bd02d920c1dd6b5414ffe249de0c3778311d
-
SHA512
9a85f8bf9459a520ece936707eb6e05e91c30af430c7f5abb5cfbcbd3607945d663fc9cfb5ee6e09824d7254fce4a9d1ffc7424762e08d4648388bb13a4f999a
-
SSDEEP
12288:CUg6vSY+mbijB5EZ4lGjTFsrxFTX87SQunONsdfC42nYWLnpmeHPFU9D4VWFmgpj:zvSxzjBmZtlsSgpCKWTTH5WIgp1JSQF
Static task
static1
Behavioral task
behavioral1
Sample
3e21b228b8e069458460dc632de5d378f51ff7438a26197c50193580ec68e78d.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
3e21b228b8e069458460dc632de5d378f51ff7438a26197c50193580ec68e78d.exe
Resource
win10v2004-20240412-en
Malware Config
Extracted
remcos
RemoteHost
107.175.229.139:8087
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
5
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
yes.png
-
keylog_flag
false
-
keylog_folder
aka
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
jhudguiytgu-AAHEXC
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
-
Target
3e21b228b8e069458460dc632de5d378f51ff7438a26197c50193580ec68e78d.exe
-
Size
878KB
-
MD5
d8fa6959c7765d689fa7e3281b46bfb8
-
SHA1
804ae2c2cb08375cdbb1876dc3234e8d91841747
-
SHA256
3e21b228b8e069458460dc632de5d378f51ff7438a26197c50193580ec68e78d
-
SHA512
14d94047d1fd5db1ce50f323f6adaadbfc4f1e7640fbaa879fb3d6034d037ed5d2cf588f0fb595b27a807f0be318f5f93dbb7fc38d2a72aa424bc0a7a3a05fcd
-
SSDEEP
24576:zox7nA7gNJV41GiEd1zjIM3Ybl2ES01FzqItCctn:Ex7nAwBi8FD3Y4yz3tCctn
Score10/10-
NirSoft MailPassView
Password recovery tool for various email clients
-
NirSoft WebBrowserPassView
Password recovery tool for various web browsers
-
Nirsoft
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook accounts
-
Suspicious use of SetThreadContext
-