General
-
Target
z1SWIFT_YOR406100432.exe
-
Size
750KB
-
Sample
240809-k5b3gasgjg
-
MD5
01bb109640de25e5052b991261824f1c
-
SHA1
e539fb8e8a9cb6b5b7c11b8de3a782ede04de2dd
-
SHA256
2bda6048a888003443cd18df65f75441974ea3dfa04d524c957b0d7c268654dc
-
SHA512
e2d6607a0eb500da7f5c8a98028d89d0c1e290642c5033072507b2de0bec711ba7e299cd29ce4965c03ae739c9c86620697ff009deee39528b1cbc5225758563
-
SSDEEP
12288:uh0vbB0rdv7/vGFJJu1Z7kjNfKWS4k5QVqNE8AknzmmtpTqJYQ:uhMt+v7/vGFJJunWSTj0YZFHQ
Static task
static1
Behavioral task
behavioral1
Sample
z1SWIFT_YOR406100432.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
z1SWIFT_YOR406100432.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
Malware Config
Extracted
remcos
RemoteHost
45.66.231.198:2404
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-UPNP8J
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
-
Target
z1SWIFT_YOR406100432.exe
-
Size
750KB
-
MD5
01bb109640de25e5052b991261824f1c
-
SHA1
e539fb8e8a9cb6b5b7c11b8de3a782ede04de2dd
-
SHA256
2bda6048a888003443cd18df65f75441974ea3dfa04d524c957b0d7c268654dc
-
SHA512
e2d6607a0eb500da7f5c8a98028d89d0c1e290642c5033072507b2de0bec711ba7e299cd29ce4965c03ae739c9c86620697ff009deee39528b1cbc5225758563
-
SSDEEP
12288:uh0vbB0rdv7/vGFJJu1Z7kjNfKWS4k5QVqNE8AknzmmtpTqJYQ:uhMt+v7/vGFJJunWSTj0YZFHQ
Score10/10-
Loads dropped DLL
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-
-
-
Target
$PLUGINSDIR/System.dll
-
Size
12KB
-
MD5
0d7ad4f45dc6f5aa87f606d0331c6901
-
SHA1
48df0911f0484cbe2a8cdd5362140b63c41ee457
-
SHA256
3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
-
SHA512
c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
-
SSDEEP
192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
Score3/10 -