General

  • Target

    b659153a656edc808c9870371571beac589bc088dd3d80c55500328554e26f2b

  • Size

    124KB

  • MD5

    6c2bba6a42a036a1519342ead85dd0ea

  • SHA1

    ac4fc9fd191266231f7afafed73da97d77248014

  • SHA256

    b659153a656edc808c9870371571beac589bc088dd3d80c55500328554e26f2b

  • SHA512

    63c2ca0843e069dba2d56431269742056950bbbd772cb798e6786ebdbe1ea9ac26d6a8d2f32590e19acbcd95b01d39ab623c039facf79d4aaf1855561e7415d2

  • SSDEEP

    3072:MGuV8ukp57/RLyBlNJo4s5ln8m5IYNGDk4Ozqhcwrc+5:MGuVUD7/5yBP3s5p8m5IYNGDtOzqhc8

Score
10/10

Malware Config

Extracted

Family

remcos

Version

2.4.5 Pro

Botnet

Remote%Host

C2

www.rmagent.biz:7181

Attributes
  • audio_folder

    MicRecords

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    vbs.server.exe

  • copy_folder

    vbs.server

  • delete_file

    true

  • hide_file

    true

  • hide_keylog_file

    false

  • install_flag

    false

  • install_path

    %AppData%

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    Remcos-00GA1C

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    vbs.server

  • take_screenshot_option

    false

  • take_screenshot_time

    5

  • take_screenshot_title

    wikipedia;solitaire;

Signatures

  • Remcos family
  • detects Windows exceutables potentially bypassing UAC using eventvwr.exe 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • b659153a656edc808c9870371571beac589bc088dd3d80c55500328554e26f2b
    .exe windows:4 windows x86 arch:x86

    e614da0834fa05db0c29913dd3f46013


    Headers

    Imports

    Sections