General
-
Target
b659153a656edc808c9870371571beac589bc088dd3d80c55500328554e26f2b
-
Size
124KB
-
Sample
240524-cpqlxshf9z
-
MD5
6c2bba6a42a036a1519342ead85dd0ea
-
SHA1
ac4fc9fd191266231f7afafed73da97d77248014
-
SHA256
b659153a656edc808c9870371571beac589bc088dd3d80c55500328554e26f2b
-
SHA512
63c2ca0843e069dba2d56431269742056950bbbd772cb798e6786ebdbe1ea9ac26d6a8d2f32590e19acbcd95b01d39ab623c039facf79d4aaf1855561e7415d2
-
SSDEEP
3072:MGuV8ukp57/RLyBlNJo4s5ln8m5IYNGDk4Ozqhcwrc+5:MGuVUD7/5yBP3s5p8m5IYNGDtOzqhc8
Malware Config
Extracted
remcos
2.4.5 Pro
Remote%Host
www.rmagent.biz:7181
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
vbs.server.exe
-
copy_folder
vbs.server
-
delete_file
true
-
hide_file
true
-
hide_keylog_file
false
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Remcos-00GA1C
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
vbs.server
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
wikipedia;solitaire;
Targets
-
-
Target
b659153a656edc808c9870371571beac589bc088dd3d80c55500328554e26f2b
-
Size
124KB
-
MD5
6c2bba6a42a036a1519342ead85dd0ea
-
SHA1
ac4fc9fd191266231f7afafed73da97d77248014
-
SHA256
b659153a656edc808c9870371571beac589bc088dd3d80c55500328554e26f2b
-
SHA512
63c2ca0843e069dba2d56431269742056950bbbd772cb798e6786ebdbe1ea9ac26d6a8d2f32590e19acbcd95b01d39ab623c039facf79d4aaf1855561e7415d2
-
SSDEEP
3072:MGuV8ukp57/RLyBlNJo4s5ln8m5IYNGDk4Ozqhcwrc+5:MGuVUD7/5yBP3s5p8m5IYNGDtOzqhc8
Score10/10-
Remcos
Remcos is a closed-source remote control and surveillance software.
-