General
-
Target
e170df17e44da6ad6893f2b6be217d9be0150cf6cd30ed30dda4c8fb5c71e392
-
Size
521KB
-
MD5
dead721a2705fe7ec11a680a6f25158f
-
SHA1
c02d3b8a26e50557a67b4d29362ff5733c88f723
-
SHA256
e170df17e44da6ad6893f2b6be217d9be0150cf6cd30ed30dda4c8fb5c71e392
-
SHA512
85e1d3fc40294864757a3c2fbd418f3cfb1209f41bd2c6b1da1893a838a0d05d941e77c322a4748e0c65b662a6477ee4577d6a510c20dcde0f7e853134e89f74
-
SSDEEP
6144:uTz+c6KHYBhDc1RGJdv//NkUn+N5Bkf/0TELRvIZPjbsAOZZXAXkcrOT4:uTlrYw1RUh3NFn+N5WfIQIjbs/ZXBT4
Score
10/10
Malware Config
Extracted
Family
remcos
Botnet
Exploit001
C2
apostlejob2.duckdns.org:2468
192.161.184.44:2468
Attributes
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-OGO4HJ
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
e170df17e44da6ad6893f2b6be217d9be0150cf6cd30ed30dda4c8fb5c71e392
1389569a3a39186f3eb453b501cfe688
Headers
Imports
Sections