Static

static

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    download_reversed_respaldo.exe

  • Size

    482KB

  • MD5

    1568abb08de05c87e94ce4f639a05636

  • SHA1

    252144cdb90c9afd1b88cfa092fddfdb286d0a19

  • SHA256

    fdb4361702ff1a7dbab2ad1a6251f3e74d608e47e8090e074e9e3b091bf18fac

  • SHA512

    b961ffdbdcefe76f475f3d84edad816ca1ce65b911c7bee302fb35b25d99dd50569d5519dc6741e07729677d36c6688e6b3cfec59a0866cf2eb9044b62d4df50

  • SSDEEP

    6144:0XIktXfM8Lv86r9uVWAa2je4Z5zl4hgDHQQs4NTQjoHFsAOZZDAXYcN+5Gv:0X7tPMK8ctGe4Dzl4h2QnuPs/ZDrcv

Score
10/10
respaldoremcos

Malware Config

Extracted

Family

remcos

Botnet

RESPALDO

C2

wwwwwwwwww.duckdns.org:2001

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    registros.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-H8NYQP

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Capturas de pantalla

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos family
    remcos
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • download_reversed_respaldo.exe
    .exe windows:5 windows x86 arch:x86

    8d5087ff5de35c3fbb9f212b47d63cad


    Headers

    Imports

    Sections