General

  • Target

    c3a3e14fe23932fae3b25d5845274b981ca64a465ec56fe2f042dbfe05568d16.exe

  • Size

    483KB

  • MD5

    f4e63286a64b5f4ac456af21c0959113

  • SHA1

    cf775ac158f2cfb38c1b42eb7518c5fba3df29e0

  • SHA256

    c3a3e14fe23932fae3b25d5845274b981ca64a465ec56fe2f042dbfe05568d16

  • SHA512

    a9eddabad172b1ecb9c5ea66a0221fa7615e8ad6cfa8c91a0eaeefaaa5d2724d8856714a7f58ee8917f0730f1cb4a1b43a49fbbaa7dd84db2283ba05f2c3918c

  • SSDEEP

    6144:wTz+c6KHYBhDc1RGJdv//NkUn+N5Bkf/0TELRvIZPjbsAOZZBAXccroT4:wTlrYw1RUh3NFn+N5WfIQIjbs/ZBrT4

Score
10/10

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

remcosco222.duckdns.org:7877

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-FX5B2Y

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • c3a3e14fe23932fae3b25d5845274b981ca64a465ec56fe2f042dbfe05568d16.exe
    .exe windows:5 windows x86 arch:x86

    1389569a3a39186f3eb453b501cfe688


    Headers

    Imports

    Sections

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.