General
-
Target
b82af15fe460e1fb13cd435cf23a16c9a6e8b410d314e6ecff4b5f8ef7730946
-
Size
819KB
-
Sample
250404-d2j6cayyat
-
MD5
38287e700d8962544a2e395b0116e2f2
-
SHA1
30f52ab354466f6d9781f7c66b55f05f6ac44f0f
-
SHA256
b82af15fe460e1fb13cd435cf23a16c9a6e8b410d314e6ecff4b5f8ef7730946
-
SHA512
3a87f87ea3263d6bc7db7358441667828ead0414ade73ddc61854b82fba95a0aa56f62e84b1a9c116b858e11733a523a5b3c8145c3a7eb48e2c95315f8f7a7c7
-
SSDEEP
12288:10Cu6BM0NFuJLxc/t3SJrFSiaNaYaxe6viSTsR1lnurz79Chp:1r1B9IJLS10oNBAe6hTe1dGz79Chp
Malware Config
Extracted
remcos
RemoteHost
193.222.96.222:2404
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
true
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-QZQ9S9
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
-
Target
PO_115142pdf.exe
-
Size
917KB
-
MD5
d09c95b9fecad316b637740b3f869318
-
SHA1
6e04663afafacc5dd89425a771a180eebe689349
-
SHA256
81aba97e6129afeb03193f6cd4f57faa50997c40ef62ecf2b293ea54785b698e
-
SHA512
237f8cb5d5f5221370fd1677a8eafb7f6fad7878887a6bbefe7657ef4a5db3f52a2a10d5ba2931087473376b719a97f890f372786ae50f57f14ece1909b8bbf6
-
SSDEEP
12288:wYimDBA8NFYJLxcfB3sfrF0waNaYIxe6voaTspllnur5V90f:wYimDBXWJLSZ+eNBSe6BTwldG5V90f
Score10/10-
Guloader family
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Remcos
Remcos is a closed-source remote control and surveillance software.
-
Remcos family
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
NirSoft MailPassView
Password recovery tool for various email clients
-
NirSoft WebBrowserPassView
Password recovery tool for various web browsers
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
-
Target
$PLUGINSDIR/System.dll
-
Size
12KB
-
MD5
cff85c549d536f651d4fb8387f1976f2
-
SHA1
d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
-
SHA256
8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
-
SHA512
531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
-
SSDEEP
192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
Score3/10 -