General
-
Target
6f4b9a86ae77415b5497874919ddf6d1.exe
-
Size
1.9MB
-
Sample
241124-h2sjyazjey
-
MD5
6f4b9a86ae77415b5497874919ddf6d1
-
SHA1
1986f8eb59766fca81c04ee26ce36e6f0aca0a99
-
SHA256
a6efd2f90c60aa91d0066df9ec79d8a72d99e942d49c8e7327f82c58b86077a8
-
SHA512
8b818fd1531b45a47571dfebdc8730114bbad58ec6db64f81591ee78ea84eee0c07074c38475c994a44b36324b3f22fc3de201e4dc4bfb39019e2700c7c02ba2
-
SSDEEP
49152:FVg5tQ7aWpVDYcHDNYiOE/rvSt7Ch+aodoHwGgQG5:rg56Zhj+iO8SB3DbQ
Static task
static1
Behavioral task
behavioral1
Sample
6f4b9a86ae77415b5497874919ddf6d1.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
6f4b9a86ae77415b5497874919ddf6d1.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
remcos
RemoteHost
162.251.122.86:6644
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-CGA6IQ
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
-
Target
6f4b9a86ae77415b5497874919ddf6d1.exe
-
Size
1.9MB
-
MD5
6f4b9a86ae77415b5497874919ddf6d1
-
SHA1
1986f8eb59766fca81c04ee26ce36e6f0aca0a99
-
SHA256
a6efd2f90c60aa91d0066df9ec79d8a72d99e942d49c8e7327f82c58b86077a8
-
SHA512
8b818fd1531b45a47571dfebdc8730114bbad58ec6db64f81591ee78ea84eee0c07074c38475c994a44b36324b3f22fc3de201e4dc4bfb39019e2700c7c02ba2
-
SSDEEP
49152:FVg5tQ7aWpVDYcHDNYiOE/rvSt7Ch+aodoHwGgQG5:rg56Zhj+iO8SB3DbQ
-
Remcos family
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses Microsoft Outlook accounts
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-