General
-
Target
c67322b1af341b8fc8440dea965a810e693313d96082f2cff2a56e7c3f311336N
-
Size
1.1MB
-
Sample
241102-yx8claxjfp
-
MD5
8ce5af58d78512f2513e5fc9dcf2c4e0
-
SHA1
6210ae0724fcb2567d97ba0acd48cff0c0bed957
-
SHA256
c67322b1af341b8fc8440dea965a810e693313d96082f2cff2a56e7c3f311336
-
SHA512
15b1b8c937c19feafdfad3aaee820df37f9f5f7ad01f2db87afdce016bedcaf759a661dd251390cffc25a092fce345590f206e3d2075f78075aee5a2b3aa8483
-
SSDEEP
24576:GsoXUz9SoO7FBsChI6xKbViWYs1rT+tqEqh+db+mZ5:1oX0934KqKbVRYsrT+tq5c+W
Static task
static1
Behavioral task
behavioral1
Sample
c67322b1af341b8fc8440dea965a810e693313d96082f2cff2a56e7c3f311336N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
c67322b1af341b8fc8440dea965a810e693313d96082f2cff2a56e7c3f311336N.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
remcos
RemoteHost
www.caampass.com:5577
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-RPV3M2
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
-
Target
c67322b1af341b8fc8440dea965a810e693313d96082f2cff2a56e7c3f311336N
-
Size
1.1MB
-
MD5
8ce5af58d78512f2513e5fc9dcf2c4e0
-
SHA1
6210ae0724fcb2567d97ba0acd48cff0c0bed957
-
SHA256
c67322b1af341b8fc8440dea965a810e693313d96082f2cff2a56e7c3f311336
-
SHA512
15b1b8c937c19feafdfad3aaee820df37f9f5f7ad01f2db87afdce016bedcaf759a661dd251390cffc25a092fce345590f206e3d2075f78075aee5a2b3aa8483
-
SSDEEP
24576:GsoXUz9SoO7FBsChI6xKbViWYs1rT+tqEqh+db+mZ5:1oX0934KqKbVRYsrT+tq5c+W
Score10/10-
Remcos family
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-