General
-
Target
8c9ccb64d62d5489eb7c3c8febf700292a696f69f4ee93bb1ad607531a93c028
-
Size
2.0MB
-
MD5
0b23b73c4a523c12688053a9577b9259
-
SHA1
eef7d5c6d2a5dbeca8bdb53395dc6809e82f1386
-
SHA256
8c9ccb64d62d5489eb7c3c8febf700292a696f69f4ee93bb1ad607531a93c028
-
SHA512
5033eee21e0f7e2d410ec83b2b18bdd407aa38d7028b657887fb8a33419c29070ad1ec839f025b93f22d06529fd78fb1b48033f6463f6d6925aa233e170c3b36
-
SSDEEP
24576:x0Zp+ViehBWY0ZXn5+uWaPeKF0tetZtWvcybaaj+LMd9WQ9YnDCJcTt+h7+:niIB90ZXn0uWIs+L2kXZ+h7+
Score
10/10
Malware Config
Extracted
Family
remcos
Botnet
RemoteHost
C2
80.85.154.131:1122
Attributes
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
bag.exe
-
copy_folder
bag
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
true
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
Bag loger
-
mouse_option
false
-
mutex
Rmc-CE8V5B
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
8c9ccb64d62d5489eb7c3c8febf700292a696f69f4ee93bb1ad607531a93c028
88381b84da56810b869e897e6d45bd58
Headers
Imports
Sections