General
-
Target
d92bfa7fbd7f110fcd34314fd08f05a7.bin
-
Size
215KB
-
Sample
240727-eeywnawank
-
MD5
91a7dc533505bd35ebfb2ee8b49c639b
-
SHA1
c112ee421fcde4845f933cba1488199aeb6bd271
-
SHA256
14bc37ff1b252a72b518c0d2ebb12bbfd71716ba087e3a709e23587905afa68d
-
SHA512
a68bd5360f60ced8d383df279a193f22bd6d472408521336760fc0f1c8ceaa38d81c9f782ebf07afa8a7ba5bb53a4ef557ab2263e276bc684c988b4f94532849
-
SSDEEP
6144:aOvbSWTcnelP2IkpYmxvrYnr85O0ExzoyMXLpib5w:aOTClD288vhIbpib5w
Behavioral task
behavioral1
Sample
5a06da89d65a9ee2823551d73c4fe1fd59c0eb8109089d3c6d9c355dd2d64127.exe
Resource
win7-20240708-en
Malware Config
Extracted
remcos
PARROT
rnnfibiteammony.duckdns.org:4233
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-R9MTHF
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
-
Target
5a06da89d65a9ee2823551d73c4fe1fd59c0eb8109089d3c6d9c355dd2d64127.exe
-
Size
233KB
-
MD5
d92bfa7fbd7f110fcd34314fd08f05a7
-
SHA1
278c5aac15e57f2ab0a6809d1952dc32a277fc0d
-
SHA256
5a06da89d65a9ee2823551d73c4fe1fd59c0eb8109089d3c6d9c355dd2d64127
-
SHA512
cde4917c5545d60ef3f8753d236ccd16ca381aec4576c83dca1672ce49a45cdd8293a085ebba6a4ece80ec2178b2c11567446eaa9b34f337dc4f52a1931b1252
-
SSDEEP
6144:Vmvl3n8iOiB4RBucKa3h80tK2gBWvADGGwQeN:kvlX8i8RB5JvADGG/e
-