General
-
Target
86c87988e4c163f7b19bd68555c9d019.bin
-
Size
886KB
-
Sample
240424-b2dx8adg93
-
MD5
8d29d9ca693a65c7cf63d2a55b636814
-
SHA1
dbe46785ea526435edbf489d9da6f3c8b958d720
-
SHA256
e8a27b983c6583f457b7d7db717139694f63c90e82560141e4c4ff32ecf5a76e
-
SHA512
bcba3d35b0c56a839c7d6440ac66d8281ee4aed2ce92c186e4b99a1ed9d0b71950a4590fc0a498aa2b151e62e38174a38a169fdbe4457741a0e472f16ebe4328
-
SSDEEP
24576:R8T+cKBOGKCWn49H6EvIAoJly/Ejuupe3b4zM:R8wlKC849H6Evrz/Ej9eb/
Static task
static1
Behavioral task
behavioral1
Sample
1fecd8f9260d65863bd4ec9e8818b618ee01c741316dc20234bd715d0940eb22.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1fecd8f9260d65863bd4ec9e8818b618ee01c741316dc20234bd715d0940eb22.exe
Resource
win10v2004-20240412-en
Malware Config
Extracted
remcos
RemoteHost
myumysmeetr.ddns.net:2404
mysmeetr.ddns.net:2404
meetre1ms.freeddns.org:2404
bbhmeetre1ms.freeddns.org:2404
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
WINWIN-K4ZHB5
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
-
Target
1fecd8f9260d65863bd4ec9e8818b618ee01c741316dc20234bd715d0940eb22.exe
-
Size
1.4MB
-
MD5
86c87988e4c163f7b19bd68555c9d019
-
SHA1
5279f39755dc24f3044299d6ecd64ac63ec73ca7
-
SHA256
1fecd8f9260d65863bd4ec9e8818b618ee01c741316dc20234bd715d0940eb22
-
SHA512
255dc520135189363dfb7505e71dc4f98806d74714d8f82755379ab91bfb1ccdfa89605cc26820bd5d9b50bf1ddc83a44d2ac770b6a0f724d7ce19b604ddb9b8
-
SSDEEP
24576:/6iXI/6AsGqohuP2v8rT3rM9qTgtAxMXYu9jz+ghCnCP6Zwras/:i8bTrM9IoS0jz+gwnAj
Score10/10-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-