General
-
Target
b23537aaa971ac525acf0b7359c3f070N.exe
-
Size
1.1MB
-
Sample
240727-lva8vsvdqf
-
MD5
b23537aaa971ac525acf0b7359c3f070
-
SHA1
ed6ddebbb6f03666b5187729d825049c3845a978
-
SHA256
03550c6a36f058711b8658422f63a2715f651132c72a6d6f6adcbc2165b56ae4
-
SHA512
4bcd49ea28ce73d2b97d02558dbf2d73d6d9a90cd9d7db8f0ae6e9173d7ebf12f1fbccc19151495ab1910bf48c9088ed739753d939735181aa682a0fcf79d3c0
-
SSDEEP
12288:f3l8mDi+ndmDIv3Zdp9j22pqjBTw4VbRGYBitfFBHTQIabY9nQZSCpdbvLRD:O+ngDU3rnDKBMEbRPWFdQ5biQ/pxLRD
Static task
static1
Behavioral task
behavioral1
Sample
b23537aaa971ac525acf0b7359c3f070N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
b23537aaa971ac525acf0b7359c3f070N.exe
Resource
win10v2004-20240709-en
Malware Config
Extracted
remcos
RemoteHost
107.175.229.139:8823
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-2BGC0K
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
-
Target
b23537aaa971ac525acf0b7359c3f070N.exe
-
Size
1.1MB
-
MD5
b23537aaa971ac525acf0b7359c3f070
-
SHA1
ed6ddebbb6f03666b5187729d825049c3845a978
-
SHA256
03550c6a36f058711b8658422f63a2715f651132c72a6d6f6adcbc2165b56ae4
-
SHA512
4bcd49ea28ce73d2b97d02558dbf2d73d6d9a90cd9d7db8f0ae6e9173d7ebf12f1fbccc19151495ab1910bf48c9088ed739753d939735181aa682a0fcf79d3c0
-
SSDEEP
12288:f3l8mDi+ndmDIv3Zdp9j22pqjBTw4VbRGYBitfFBHTQIabY9nQZSCpdbvLRD:O+ngDU3rnDKBMEbRPWFdQ5biQ/pxLRD
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
NirSoft MailPassView
Password recovery tool for various email clients
-
NirSoft WebBrowserPassView
Password recovery tool for various web browsers
-
Drops startup file
-
Accesses Microsoft Outlook accounts
-
Suspicious use of SetThreadContext
-