Overview

overview

10

Static

static

10

1716402727...ed.exe

windows7-x64

9

1716402727...ed.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    17164027273924b1df179f71bcdb4f6ddb0b6e02da51a5acba32646b7f91c4ab7945caaa21327.dat-decoded.exe

  • Size

    483KB

  • MD5

    59efc1091f942da11955f59541eb8362

  • SHA1

    849d9ffefa30dc439809c4bdf1c1440159d39fe4

  • SHA256

    5f8edf465a52b81e0c048dc42f4b975bdf7a3e8a77e1677b52793422b12e7d90

  • SHA512

    e988c07b70bd14e68872db122c5743f530f88085587a261d188a905848bb2b51b15f52c8c02b4592233af3c5dd7461515bc7b5e78bba172c8a15ef5d0a84ceee

  • SSDEEP

    6144:2XIktXfM8Lv86r9uVWAa2je4Z5zl4hgDHQQs4NTQjoHFsAOZZDAXYcNX5Gv:2X7tPMK8ctGe4Dzl4h2QnuPs/ZDGcv

Score
10/10
newremcos

Malware Config

Extracted

Family

remcos

Botnet

New

C2

hoacanhceramic.com:14782

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-4X155W

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos family
    remcos
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 17164027273924b1df179f71bcdb4f6ddb0b6e02da51a5acba32646b7f91c4ab7945caaa21327.dat-decoded.exe
    .exe windows:5 windows x86 arch:x86

    8d5087ff5de35c3fbb9f212b47d63cad


    Headers

    Imports

    Sections