General
-
Target
06042025_1758_02042025_Salary Details Month of March - 2025.rar
-
Size
872KB
-
Sample
250406-wketeavvcv
-
MD5
0998b8a035c3015d0ba34ee724f3b1cc
-
SHA1
9a51caddce46536513dd9293516721c958d07630
-
SHA256
766e4aa393eaf42800c89e5a30e8a08eb07c2e44d7ab44bc72d4a4b1d9e34fb5
-
SHA512
8ca204c6f6067940f6af5dbe8de488530f9fee3b2055aa009e3ab7dfc66fd7d7717de44618642258904857865f9b5cda891920da58c0181d4f1ed11082e43b74
-
SSDEEP
24576:oicDCNuRbmjLFbCenbDRzmzYjQ7dX2ceI1ddhvjXS:oDCdJCebxFEcZQdv7S
Malware Config
Extracted
remcos
RemoteHost
196.251.86.105:2404
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
true
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-MJDICZ
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
-
Target
Salary Details Month of March - 2025.exe
-
Size
891KB
-
MD5
65caba40da61edd68d837b5e47e69fee
-
SHA1
5ee39e2884fa198d2050f0933d48992b29f1adb8
-
SHA256
67a2ac272b1c5c9fcc018a7819ed78e194e5460ad98d7cdda14501d15454959b
-
SHA512
8229be74977fb39215c217e02bf8f07ff7bafae830c75ed5fb4a5b8ebb02ed70d0e1fd7361fe49a16af8b1d70bdc80912f95c1d1acafbac0f626ec0ffb9f3c34
-
SSDEEP
24576:qNJMqk+xQFPPwHrUo2Vlu3nbKrcCVAfScJ81u/:a+V+GPYrN2y3bm7VYJ81A
Score10/10-
Guloader family
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Remcos
Remcos is a closed-source remote control and surveillance software.
-
Remcos family
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
NirSoft MailPassView
Password recovery tool for various email clients
-
NirSoft WebBrowserPassView
Password recovery tool for various web browsers
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
Drops file in System32 directory
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
-
Target
$PLUGINSDIR/System.dll
-
Size
12KB
-
MD5
cff85c549d536f651d4fb8387f1976f2
-
SHA1
d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
-
SHA256
8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
-
SHA512
531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
-
SSDEEP
192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
Score3/10 -