Overview

overview

10

Static

static

10

7c1c2c54b4...ea.exe

windows7-x64

3

7c1c2c54b4...ea.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d61e8883e8c9d4c92493839bb4a34e54.bin

  • Size

    259KB

  • Sample

    241018-can5jssfkk

  • MD5

    aac916c6202c98d2c5ac4f686952ce61

  • SHA1

    ae7f78c7a58573f79b90e5622bcb24431a888408

  • SHA256

    8e8028cc373fbf50dba9c54217e80cc1e1bfe00d972dc2352b41f19814fd3566

  • SHA512

    6199609d8dfecf9b771320b2512b400990b479feccb2032a77a3e71e5de7a5bab537c6b8f9244db46f85fb9e8edb0343f9b1ca86bef9f443bd8980d1128987b2

  • SSDEEP

    6144:8lb+FOAuHTJuzWTyDcTlEm4zvm9L9Vl87IXxeMfCZ6+x07Iwiqo6:3luHGWToWlEm4iTgAeMfAc7I3ql

Score
10/10
remcosphpdiscovery

Malware Config

Extracted

Family

remcos

Botnet

php

C2

flame.work.gd:2374

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    vlc

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    true

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    pdf

  • mouse_option

    false

  • mutex

    mac-L63HPP

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    ios

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      7c1c2c54b4c18070058284e889de5bde72396d9a5a5e959deb38cf19ed2f6aea.exe

    • Size

      469KB

    • MD5

      d61e8883e8c9d4c92493839bb4a34e54

    • SHA1

      58eb46904d8550d779d906858a95c18084d5b6fd

    • SHA256

      7c1c2c54b4c18070058284e889de5bde72396d9a5a5e959deb38cf19ed2f6aea

    • SHA512

      1d4264b5fe7e00ef462047ef5fabf465f20a1337159751baf2b25f3c1289ae13a7c6404316f0ca795a2bb66ce2607a4804404e8ed42f6187d291ff67bbf3e000

    • SSDEEP

      12288:Wmnk7iLJbpIpiRL6I2WhSKQ9ZsfZQS3n9:uiLJbpI7I2WhQqZ739

    Score
    3/10
    discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks