General
-
Target
mereallywantherkisswithlotoflovesheismostbeautifulgirlieversennsheisverybeautifl__iamtheonekissedher.doc
-
Size
71KB
-
Sample
240424-nhgwzshc3t
-
MD5
9ba84df21f3bba6e665ccf1c09b9a6f3
-
SHA1
9cef99aaa3938f09dd0c9a5d38c369ad28178394
-
SHA256
c2e154fa9e7e6019106934254eb4e0ef2699609c7eafb647c1a67907c6aaf78d
-
SHA512
d18732d4999d633eac62d4927615914c0ac49a24380f37732fbe8584b89d3dd35420df285fbf1d96410bdca41c940050387cc893e61613a3dae7b033f4b02bb2
-
SSDEEP
1536:IBrVGDKKaw0wpOst0Q5zLD4g0+niUn+ZepPzn0BlB7JfCXun5hxEyN73OxJZn/:IBRG1aw0wpOstHzLD4g0+niU+ZepT0Bu
Static task
static1
Behavioral task
behavioral1
Sample
mereallywantherkisswithlotoflovesheismostbeautifulgirlieversennsheisverybeautifl__iamtheonekissedher.rtf
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
mereallywantherkisswithlotoflovesheismostbeautifulgirlieversennsheisverybeautifl__iamtheonekissedher.rtf
Resource
win10v2004-20240226-en
Malware Config
Extracted
remcos
RemoteHost
rmcnewlistening.duckdns.org:14645
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-AK1F22
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
-
Target
mereallywantherkisswithlotoflovesheismostbeautifulgirlieversennsheisverybeautifl__iamtheonekissedher.doc
-
Size
71KB
-
MD5
9ba84df21f3bba6e665ccf1c09b9a6f3
-
SHA1
9cef99aaa3938f09dd0c9a5d38c369ad28178394
-
SHA256
c2e154fa9e7e6019106934254eb4e0ef2699609c7eafb647c1a67907c6aaf78d
-
SHA512
d18732d4999d633eac62d4927615914c0ac49a24380f37732fbe8584b89d3dd35420df285fbf1d96410bdca41c940050387cc893e61613a3dae7b033f4b02bb2
-
SSDEEP
1536:IBrVGDKKaw0wpOst0Q5zLD4g0+niUn+ZepPzn0BlB7JfCXun5hxEyN73OxJZn/:IBRG1aw0wpOstHzLD4g0+niU+ZepT0Bu
-
NirSoft MailPassView
Password recovery tool for various email clients
-
NirSoft WebBrowserPassView
Password recovery tool for various web browsers
-
Nirsoft
-
Blocklisted process makes network request
-
Accesses Microsoft Outlook accounts
-
Adds Run key to start application
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-