General
-
Target
a4e7c1a4bb830c731b60d90c8dea0f01367c3bdc74ae782edfee29507960f2e4.exe
-
Size
481KB
-
MD5
f304fc01ee11d8249245b35c4fa4191b
-
SHA1
147a961c90cda69b8acbc12cf07c5d25762b625c
-
SHA256
a4e7c1a4bb830c731b60d90c8dea0f01367c3bdc74ae782edfee29507960f2e4
-
SHA512
9a924cbc7c47ddd1e0e067a9063ba9b526f224fd6e28e6fe9bcfa5ecd74f6bc2baf509a40cbcb4d6bcb76f0d316c6f165ff834719d2a9dd250d1659c2c55c2ce
-
SSDEEP
12288:LuD09AUkNIGBYYv4eK13x13nZHSRVMf139F5wIB7+IwtHwBtVxbesvZDSo+DYj:O09AfNIEYsunZvZ19ZTsC
Score
10/10
Malware Config
Extracted
Family
remcos
Botnet
RemoteHost
C2
shlobo.duckdns.org:9687
shlobo.duckdns.org:9374
shlobo.duckdns.org:8764
Attributes
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-U2TQ1C
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
a4e7c1a4bb830c731b60d90c8dea0f01367c3bdc74ae782edfee29507960f2e4.exe
e77512f955eaf60ccff45e02d69234de
Headers
Imports
Sections