Overview

overview

10

Static

static

10

9c3b079f39...57.exe

windows7-x64

1

9c3b079f39...57.exe

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    13b9fa4a37a331e566252a6dc502751fe40e5aec205016073918eaa8c5b15ceb

  • Size

    265KB

  • MD5

    42d9f0efe7a8a9ee82764b1c0c0f2d04

  • SHA1

    9275ccce7743d5e8b6a6b968a4d0d0d55352dd31

  • SHA256

    13b9fa4a37a331e566252a6dc502751fe40e5aec205016073918eaa8c5b15ceb

  • SHA512

    eb8d19a52deb90d68aaeb2caefcc3c07b7e233754f6f357377d439047a77bf384f9c0c0c9fdf7c9972172d1c7156580a8dc3eb63271476078d838673652a9254

  • SSDEEP

    6144:ESWYsOXEzNEdJRHLpZS4RAxx7nHxckNr5E+uZx8dlpKAVBut0dMJF5Z:PvEzN4JR9Nax7nHlrO+JIRFb

Score
10/10
remotehostremcos

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

reco8100may.duckdns.org:8100

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-RFBNVH

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos family
    remcos
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 13b9fa4a37a331e566252a6dc502751fe40e5aec205016073918eaa8c5b15ceb
    .zip

    Password: infected

  • 9c3b079f39ef256fc7bfc6cf55cd5f6bd0e58af3bbad9d573e87900898c7a057.exe
    .exe windows:5 windows x86 arch:x86

    8d5087ff5de35c3fbb9f212b47d63cad


    Headers

    Imports

    Sections