General
-
Target
9745158a44764f2c56f32f93658380e0_NeikiAnalytics.exe
-
Size
124KB
-
Sample
240525-dbeg6scb78
-
MD5
9745158a44764f2c56f32f93658380e0
-
SHA1
f2f84ac2e32fd8bbe804cc172ae0579274622a87
-
SHA256
0979159201a936120d137b6a1669c1bf9913483e8b261b8b40f6d150908b7ddf
-
SHA512
2b82c809e03de8023929e936cf093e3a64c0c663170a9827ac350492b4d980b5084b5c03356e2e898bef0bcf49008c5d957aa06d7bd3299814d67702fa34dce2
-
SSDEEP
3072:4d8jGSsTMh7pqhCiE5xc4UbzyU4OzqhEWrc+5:kuGrQ7qE5xcsdOzqhEi
Behavioral task
behavioral1
Sample
9745158a44764f2c56f32f93658380e0_NeikiAnalytics.exe
Resource
win7-20240508-en
Malware Config
Extracted
remcos
2.4.5 Pro
Remote%Host
www.rmagent.biz:7181
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
vbs.server.exe
-
copy_folder
vbs.server
-
delete_file
true
-
hide_file
true
-
hide_keylog_file
false
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Remcos-00GA1C
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
vbs.server
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
wikipedia;solitaire;
Targets
-
-
Target
9745158a44764f2c56f32f93658380e0_NeikiAnalytics.exe
-
Size
124KB
-
MD5
9745158a44764f2c56f32f93658380e0
-
SHA1
f2f84ac2e32fd8bbe804cc172ae0579274622a87
-
SHA256
0979159201a936120d137b6a1669c1bf9913483e8b261b8b40f6d150908b7ddf
-
SHA512
2b82c809e03de8023929e936cf093e3a64c0c663170a9827ac350492b4d980b5084b5c03356e2e898bef0bcf49008c5d957aa06d7bd3299814d67702fa34dce2
-
SSDEEP
3072:4d8jGSsTMh7pqhCiE5xc4UbzyU4OzqhEWrc+5:kuGrQ7qE5xcsdOzqhEi
-