Overview

overview

10

Static

static

10

4c28b6d532...ef.exe

windows7-x64

1

4c28b6d532...ef.exe

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    aa56f6c65f085f53c851c0ba89692bab.bin

  • Size

    265KB

  • MD5

    ca6e887c8ed9d93adfab5ff485ab1610

  • SHA1

    2794ed1632af43d9ab89f6528f7852ad6bf45366

  • SHA256

    ca7052003ebd3a3c545db762615983237f07c5c27322a1c0b487d63a40d86716

  • SHA512

    3c04b1a816922bf40c6a131f175a1216e917a2a5d3d79df76737704b4973704d21e49e0aecc14d30f91dcac05c579809b586e04eb02ff6aac49ee5f7fabad1aa

  • SSDEEP

    3072:N0uYHbLSvUec1Qx+h8Kqj8OtQ3B243+Snhv+BlcZtNA44d8ajfuHhrFOq8XrYo17:pkSoI+b8KBekv+8uKxBWrWAQ73f3e

Score
10/10
lux-tihagoremcos

Malware Config

Extracted

Family

remcos

Botnet

Lux-Tihago

C2

sendfiletiahforem.ducdns.org:8889

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    Dis.dat

  • keylog_flag

    false

  • keylog_folder

    Disk

  • mouse_option

    false

  • mutex

    Rmc-YANU0I

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Capturas de pantalla

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos family
    remcos
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • aa56f6c65f085f53c851c0ba89692bab.bin
    .zip

    Password: infected

  • 4c28b6d5329d067a5887a65dd287ddd2bbdfe3e30cfea5cd023ff3971938e9ef.exe
    .exe windows:5 windows x86 arch:x86

    Password: infected

    8d5087ff5de35c3fbb9f212b47d63cad


    Headers

    Imports

    Sections