Overview

overview

10

Static

static

10

ecbb6eaa07...8d.exe

windows7-x64

3

ecbb6eaa07...8d.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ecbb6eaa070d31fa74b752458b8b715e803ac371f83c7b255fd6fb65e002568d.exe

  • Size

    482KB

  • Sample

    250116-bk9csstmc1

  • MD5

    6ffb1d961915563bd10812d2de68e083

  • SHA1

    513d4e843fde34f147c7bdd9b54fc03ea867f44c

  • SHA256

    ecbb6eaa070d31fa74b752458b8b715e803ac371f83c7b255fd6fb65e002568d

  • SHA512

    c1a02e934fe60a8a39865bc7b5b8415330293bab2fe7d9b64da21a63e546239d38656bf5e8fa49ae074b2944cc1daf92bdf2688b3c7058a04eea48592434cd51

  • SSDEEP

    12288:x13ak/mBXTG4/1v08KI7ZnMEF76JqmsvZQMS+:jak/mBXTV/R0nEF76gFZTn

Score
10/10
remcosv2discovery

Malware Config

Extracted

Family

remcos

Botnet

V2

C2

192.168.0.209:2404

Attributes
  • audio_folder

    MicRecords

  • audio_path

    ApplicationPath

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-DQJTLN

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      ecbb6eaa070d31fa74b752458b8b715e803ac371f83c7b255fd6fb65e002568d.exe

    • Size

      482KB

    • MD5

      6ffb1d961915563bd10812d2de68e083

    • SHA1

      513d4e843fde34f147c7bdd9b54fc03ea867f44c

    • SHA256

      ecbb6eaa070d31fa74b752458b8b715e803ac371f83c7b255fd6fb65e002568d

    • SHA512

      c1a02e934fe60a8a39865bc7b5b8415330293bab2fe7d9b64da21a63e546239d38656bf5e8fa49ae074b2944cc1daf92bdf2688b3c7058a04eea48592434cd51

    • SSDEEP

      12288:x13ak/mBXTG4/1v08KI7ZnMEF76JqmsvZQMS+:jak/mBXTV/R0nEF76gFZTn

    Score
    3/10
    discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks