General
-
Target
a6e8d91287f4a0330cbc3f11df45aa10N
-
Size
416KB
-
MD5
a6e8d91287f4a0330cbc3f11df45aa10
-
SHA1
e9b56b357aaf795c17a2363e96d55e8e95108f72
-
SHA256
d9c1790c8e66d496a92c0600159a8d7a54282299612e213c4421a48d7c863879
-
SHA512
cb8670d9e58fd0871393f4b3fd6cbfc2145c67b7511d91dac2b4e1581fd2154efc705a26e7edfb92460d892cbd3956e09d3d3211c44765004bed3c5c087431c6
-
SSDEEP
6144:gvRscHtVzjwIRFzJZ2p26+jFWXYnj9iT2ebvXmUcCqkmAO2djXH7d4y:gvRs4OIm2hWX4U2ebvRUAd77
Score
10/10
Malware Config
Extracted
Family
remcos
Version
5.1.1 Light
Botnet
Agent
C2
159.223.171.199:20226
Attributes
-
audio_folder
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
-
copy_folder
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
-
keylog_flag
false
-
keylog_folder
-
mouse_option
false
-
mutex
70ec85cd-0033-4f41-a280-4785c3d88479
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
Signatures
-
Remcos family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
a6e8d91287f4a0330cbc3f11df45aa10N
Headers
Sections