General
-
Target
-9553-01.tbz
-
Size
642KB
-
Sample
241002-bvvmdszgmp
-
MD5
2ede5ece9b77920b8fc06c53a12c8811
-
SHA1
551f749ce75b0b6d27c9427e73e6ec20e2bf9120
-
SHA256
dd72d4aef098a3d521a2cbea6e58ba477a2bad051aca8f15593adff4f3cb4eb3
-
SHA512
65ca937ff087c1e3560c923708f8902e86154eb8be3fc0f1c3119cd8eb6ab9f0f0f8a6c9587fff9bab3bfbcc31240b2bf770f9eed505b62a90be300f60a97ab4
-
SSDEEP
12288:82SFJZzGOmAjh/ogXexW2aGYGmJILR+LpF+D/rDgwYM6AMFwd3BGPDOAPx:8D0OmAjeDxYAmJqRqpe0wUFwdRGS8
Malware Config
Extracted
remcos
RemoteHost
172.245.93.118:25000
172.245.93.118:26000
172.245.93.118:2484
172.245.93.118:2700
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-GFGCCE
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
-
Target
?????? - ??????#9553-01.com
-
Size
657KB
-
MD5
bdf0580d6cf3a59b15f5817437a6c5a5
-
SHA1
c3de15533c82e6a56975c3a5aa42ca88ec431cb2
-
SHA256
133891fc02269ee06eb3e6ab1f20391fe1486cd5620f766c85b8fceaf223dc84
-
SHA512
936570aa56de42c565b87730ca76f6e006a8278ad893a19286f61295da4656eeaaa88ae1d684af6bc961f8af9d7b74249e5ee7f4f3d78e68cb271b8860f967d0
-
SSDEEP
12288:5XJ5r639UgrDDIVWN+YP7924lgRgPetEsVtDZoeDl51SKd0714/A:r5r6//DIVWUYj925RgPetEsVcy51pd0x
Score10/10-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Remcos
Remcos is a closed-source remote control and surveillance software.
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
NirSoft MailPassView
Password recovery tool for various email clients
-
NirSoft WebBrowserPassView
Password recovery tool for various web browsers
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-
-
-
Target
$PLUGINSDIR/System.dll
-
Size
11KB
-
MD5
b853d5d2361ade731e33e882707efc34
-
SHA1
c58b1aeabdf1cbb8334ef8797e7aceaa7a1cb6be
-
SHA256
f0cd96e0b6e40f92ad1aa0efacde833bae807b92fca19bf062c1cf8acf29484b
-
SHA512
8ea31d82ffa6f58dab5632fe72690d3a6db0be65aec85fc8a1f71626773c0974dcebefae17bcf67c4c56ef442545e985eea0b348ff6e4fc36740640092b08d69
-
SSDEEP
192:eA2HS+ihg200uWz947Wzvxu6v0MI7JOde+Ij5Z77dslFsEf:mS62Gw947ExuGDI7J8EF7KIE
Score3/10 -