General

  • Target

    remcos_a.exe

  • Size

    483KB

  • MD5

    b1b853c8e73a491934fcfb8d20c88ffd

  • SHA1

    b2b93eb66a46504fd389a6e8e207d83ff85930d8

  • SHA256

    4b80f8820d44f0b53482e7a5a5cfe6d44a0e2799055526e83d3779a241b4a639

  • SHA512

    2f3cdb5277a3d3cc8ea2418cf80d05afa9ce0af01ede5c85c65faa89143537d4742a17a5e7a70784cc995fd7e2075030b74c8e1086f5614f7528b12efff35265

  • SSDEEP

    6144:QTz+c6KHYBhDc1RGJdv//NkUn+N5Bkf/0TELRvIZPjbsAOZZBAXccrHT4:QTlrYw1RUh3NFn+N5WfIQIjbs/ZBUT4

Score
10/10

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

software-julia.gl.at.ply.gg:17106

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    true

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-SMNGDV

  • screenshot_crypt

    false

  • screenshot_flag

    true

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    true

  • take_screenshot_time

    5

  • take_screenshot_title

    roblox

Signatures

  • Remcos family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • remcos_a.exe
    .exe windows:5 windows x86 arch:x86

    1389569a3a39186f3eb453b501cfe688


    Headers

    Imports

    Sections