modiloader | 78d800daa2c85bbf244794523a10e382a440743a0586aa87d96cf114ea1ecbfe

General

Target

dcd79da0356caad135b3f7e9c1584cad_JaffaCakes118
Size

605KB
Sample

240912-xgke6ayemd
MD5

dcd79da0356caad135b3f7e9c1584cad
SHA1

61f6800b9b8fab4cef123e560d0168d4bb2e004b
SHA256

78d800daa2c85bbf244794523a10e382a440743a0586aa87d96cf114ea1ecbfe
SHA512

d0ea2c79663a543be047112180155685614a014e7044d0a483de355a1194c4bfebef4c8890bff848baeae72b79d7250410936743a4f55d4316e38226b3cf6fb1
SSDEEP

12288:oWvREz3bo+DzjiYshnKiDnNzL/YFeJjDzE5vjwT:oWJj+DzjQ7BrjDzY

Score

10^/10

Family

remcos

Version

2.5.0 Pro

Botnet

Backup

C2

54.37.160.139:34049

185.244.30.78:34046

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
Windowsregistry
keylog_path
%AppData%
mouse_option
false
mutex
onedrive-P4DR4E
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
remcos
take_screenshot_option
true
take_screenshot_time
5
take_screenshot_title
login;sigin;proforma;invoice;payment;pay;account;bank;paypal;bank;money;advance;login;credit;creditcard;https://www.lazada.com;https://www.flipkart.com;flipkart;lazada;https://www.rakuten.com;https://www.coupang.com;coupang;rakuten