General
-
Target
23082024_1416_22082024_Payment Invoice.gz
-
Size
866KB
-
Sample
240823-rllk5a1flj
-
MD5
7155d4e75e0b8347198272330f49576e
-
SHA1
0d0c272c7e52010a34f05de7fe7e5f42bd5f1c02
-
SHA256
d18efb4f76fa7ce45b90e39c8a6e462b994a73442d032f928f7e7f71c52c462a
-
SHA512
da522e95b02e729f76fbe3ac040bb17f301805ed3672f1ff9c20d6ad325aa2a571ac56d6c03079375b16cad52792f5c62fd5b374c22ae4d1f6485e78f2a76ad3
-
SSDEEP
24576:f4zw+R3C1FnflXmMbLnTq+dBS+KqT/40n:A8Oy15tXzHbdlKqTT
Static task
static1
Behavioral task
behavioral1
Sample
Payment Invoice.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
Payment Invoice.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
remcos
RemoteHost
23.95.235.18:2557
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-E0JKXE
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
-
Target
Payment Invoice.exe
-
Size
1.4MB
-
MD5
fb5cf278997f641da07612e0e6997171
-
SHA1
a76de72f1bfd3a91d12ae5a78ff5254a44233dd3
-
SHA256
5470ede6c108f4bd93c9b86548513661f033a3d71f4a644c6600007d9de81782
-
SHA512
1b2de413b34d409de7162ae8e2adb59bc41c8ead7ba0debdef47e33110578f40ec48870255ac745fb118c4489fa34bc69a11fb629588c8d983f77be26da25cc1
-
SSDEEP
24576:sqDEvCTbMWu7rQYlBQcBiT6rprG8aLn7Qx8p2WUQ/ItNEmlx/co:sTvC/MTQYxsWR7aL7dpZ/2Emlx/c
Score10/10 -