General
-
Target
71d80c8f2f09ef47ac57687801645fd3cbc1095a1d3792561aa8d2e4699a69b0.exe
-
Size
2.5MB
-
Sample
240724-wefhrasdmg
-
MD5
12674ab7ee6453ad21b117ba3854293d
-
SHA1
d7f710c160e785caab1d8d9125a05ac21f06e275
-
SHA256
71d80c8f2f09ef47ac57687801645fd3cbc1095a1d3792561aa8d2e4699a69b0
-
SHA512
7f4e74d43266cbc8e7fef4719a4ee7a44a703b781cd401b8dd663a563ea0be5760b91b356f622da75bfef4d11c3dc5e9d64593dd09409fddb53a832411a38106
-
SSDEEP
49152:+L1tS6o1woUyFuQCXw/gf0yA7Qbd+5XlMW2ahUKv8m4hcln+/FW:+PSihgO0yA775V6vrjclnT
Static task
static1
Behavioral task
behavioral1
Sample
71d80c8f2f09ef47ac57687801645fd3cbc1095a1d3792561aa8d2e4699a69b0.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
71d80c8f2f09ef47ac57687801645fd3cbc1095a1d3792561aa8d2e4699a69b0.exe
Resource
win10v2004-20240704-en
Malware Config
Extracted
remcos
RemoteHost
horsesnje.net:3343
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-TW2LKP
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
-
Target
71d80c8f2f09ef47ac57687801645fd3cbc1095a1d3792561aa8d2e4699a69b0.exe
-
Size
2.5MB
-
MD5
12674ab7ee6453ad21b117ba3854293d
-
SHA1
d7f710c160e785caab1d8d9125a05ac21f06e275
-
SHA256
71d80c8f2f09ef47ac57687801645fd3cbc1095a1d3792561aa8d2e4699a69b0
-
SHA512
7f4e74d43266cbc8e7fef4719a4ee7a44a703b781cd401b8dd663a563ea0be5760b91b356f622da75bfef4d11c3dc5e9d64593dd09409fddb53a832411a38106
-
SSDEEP
49152:+L1tS6o1woUyFuQCXw/gf0yA7Qbd+5XlMW2ahUKv8m4hcln+/FW:+PSihgO0yA775V6vrjclnT
Score10/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-