Overview

overview

10

Static

static

10

2fbe56adf0...71.exe

windows7-x64

3

2fbe56adf0...71.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2fbe56adf0ca51b7a345ef9c6004982846633cabbaf4c2d28dc11ce48c3e6d71

  • Size

    483KB

  • MD5

    ba07b7f751bfca4aa4f7b3f6bbeb0b2d

  • SHA1

    fb4310f75c6887bc0f8226d3a06fd523f144a3b7

  • SHA256

    2fbe56adf0ca51b7a345ef9c6004982846633cabbaf4c2d28dc11ce48c3e6d71

  • SHA512

    5488faf04d8d15732bb2646ddad690b87297bc57f99294dbe6e2c14fb6228154ed0333232d5b71782bcef421ef502cd9cb3e008a07c4df844ecf7e1bd0de1552

  • SSDEEP

    12288:oTlrYw1RUh3NFn+N5WfIQIjbs/ZXo4T4a:4pRUh3NDfIQIjeZ/

Score
10/10
remotehostremcos

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

188.190.10.197:2404

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-G2X73X

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos family
    remcos
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2fbe56adf0ca51b7a345ef9c6004982846633cabbaf4c2d28dc11ce48c3e6d71
    .exe windows:5 windows x86 arch:x86

    1389569a3a39186f3eb453b501cfe688


    Headers

    Imports

    Sections