General
- Target My Trip 2026.rar
- Size 892KB
- Sample260301-ryw8dsd18e
- SHA256 974ff72bef3c26888736384245c7b3e375b299b8cfa3fc4d1393960a3fd49083
Score
10/10
Malware Config
Extracted
Family
-
remcos
Botnet
-
Senders
C2
-
brajasas35safael1.duckdns.org:1771
-
brajasas35safael2.duckdns.org:1772
-
brajasas35safael3.duckdns.org:1771
-
brajasas35safael4.duckdns.org:1771
-
brajasas35safael5.duckdns.org:1771
-
brajasas35safael6.duckdns.org:1771
Attributes
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
true
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
huopes.dat
-
keylog_flag
false
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
hjmiuowql-5541S0
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
- startup_value
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
- Target My Trip 2026.rar
- Size 892KB
- SHA256 974ff72bef3c26888736384245c7b3e375b299b8cfa3fc4d1393960a3fd49083
Score10/10-
Guloader family
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Remcos
Remcos is a closed-source remote control and surveillance software.
-
Remcos family
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
- Target My Trip 2026.exe
- Size 960KB
- SHA256 14ebb260ea6108908a82c04bf28b549b8b1e897baea185b62b994ceb00f16620
Score10/10-
Guloader family
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Remcos
Remcos is a closed-source remote control and surveillance software.
-
Remcos family
-
Loads dropped DLL
-
Adds Run key to start application
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
- Target $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 f004c568d305cd95edbd704166fcd2849d395b595dff814bcc2012693527ac37
Score3/10 -
- Target $PROGRAMFILES/unguards/Hypergeusia
- Size 181KB
- SHA256 3d84247266e06205dd265b4fa9bc0c0f0669358cee36e756c8ae6c3d081bdc96
Score1/10 -
- Target Unwwoven/Camalig.ini
- Size 286B
- SHA256 e66ee5d404f7032a97267f181579d0ef893008ae82c7a7ea872b968eabaf684c
Score3/10 -
- Target Unwwoven/Cowboyen.txt
- Size 618B
- SHA256 d37fc36a97ad87e3f422657e90896bbf38f7a41af1a2a3d8d64962991673fdc0
Score3/10 -
- Target Unwwoven/Excentrikers91.txt
- Size 402B
- SHA256 3d486a2edbd2a8df18ebb39deaad004d1746cddb69cd091b251a9ec1813334d5
Score3/10 -
- Target Unwwoven/Hjernearbejderne.jpg
- Size 29KB
- SHA256 e4401f3e9168dd511881f01e6e35c45e669b635a2a3f9fc2e78e5d4bdacdc335
Score1/10 -
- Target Unwwoven/Huskesedler.txt
- Size 439B
- SHA256 a2f8741d00ea960c576ddfb1110c7cbce1cdf8fe380b9ecf97d3c8ab326857b2
Score3/10 -
- Target Unwwoven/Ironmaster.dia
- Size 1.1MB
- SHA256 ccd91e437ceb3193aa07e6c49642176d90a31322d1f5fdb1f87f0989ec45d5d7
Score3/10 -
- Target Unwwoven/Karnfle.jpg
- Size 28KB
- SHA256 f21a5be62edf8907d84cf36bda3fe595102c033eca34957dffc2e3821c08c390
Score1/10 -
- Target Unwwoven/Redningsmodellers.txt
- Size 260B
- SHA256 632072bd32ab9fc8e61dbab6e342a8bc6e4174318f85254a197bc5f7f6915eca
Score3/10 -
- Target Unwwoven/antennemodtageren.ini
- Size 559B
- SHA256 16a32bf2b21fe291b5064486535fb1021c57bc1d1363256a899ae15a99fd476c
Score3/10 -
- Target Unwwoven/astragali.dem
- Size 5.1MB
- SHA256 fe99eba92b6511e7e243431282d68f9836353394a62090d3ecf9a47e51d06a03
Score3/10 -
- Target Unwwoven/direktrskifte.txt
- Size 106B
- SHA256 b9a673deb142c37adf9665057eec56db64f2d2b392a1f29ad97de045e40da8de
Score3/10 -
- Target Unwwoven/forbindskasser.jpg
- Size 18KB
- SHA256 82d4bc43c5b43d89ae6b3efd43293218ff51d806757ad9a85f450e3ec5d3939b
Score1/10 -
- Target Unwwoven/kategoriserings.txt
- Size 636B
- SHA256 1d7e38f57870ef2b575bab4a1ce17f271fb2cf7274699737194e2b46abab2d63
Score3/10 -
- Target Unwwoven/materialiseredes.ini
- Size 444B
- SHA256 00ce37f92228600be2049a60cd81316ddb29483ed4855a0f4bed64e5141e67b6
Score3/10 -
- Target Unwwoven/microcrystal.ini
- Size 475B
- SHA256 4508cf1c5cd9513d4022c7615a0143019a25948ee8104088076adac21bb148c1
Score3/10 -
- Target precontention.els
- Size 8.5MB
- SHA256 f3d624f86b3db356ac79e3c4ae32734487573158368ff31ae2e38eba7e24a90f
Score3/10 -
- Target project.txt
- Size 373B
- SHA256 3a4891bdb0c16a6a2185769d20bec8ea8309351871e92c4e1a5ac12051d20c8a
Score3/10 -
- Target snobs.jpg
- Size 78KB
- SHA256 be58db9921b98f1032d9171b4d830b2b9b78f3087d7b3d5d10cb60f39c1e44a9
Score1/10 -
- Target tagvindues.tee
- Size 67KB
- SHA256 b65b3c38e48f28cea0a85ca19e4c3c38712df5afefa47c1bb3daefa39e36036d
Score3/10 -
- Target tantaluskvaler.ini
- Size 621B
- SHA256 7ba4a0177d74180c6debc76e47a5a1a514fa2253638021e2c0c1f57cecda9932
Score3/10 -
- Target thomsonite.ini
- Size 266B
- SHA256 93b05fd8bd52bad94f5a0fdbc4e44a8002066475b2435a633cec29a649d501b6
Score3/10
MITRE ATT&CK Enterprise v16
Tasks
static1
Score
3/10
behavioral1
Score
10/10
behavioral2
Score
10/10
behavioral3
Score
3/10
behavioral4
Score
1/10
behavioral5
Score
3/10
behavioral6
Score
3/10
behavioral7
Score
3/10
behavioral8
Score
1/10
behavioral9
Score
3/10
behavioral10
Score
3/10
behavioral11
Score
1/10
behavioral12
Score
3/10
behavioral13
Score
3/10
behavioral14
Score
3/10
behavioral15
Score
3/10
behavioral16
Score
1/10
behavioral17
Score
3/10
behavioral18
Score
3/10
behavioral19
Score
3/10
behavioral20
Score
3/10
behavioral21
Score
3/10
behavioral22
Score
1/10
behavioral23
Score
3/10
behavioral24
Score
3/10
behavioral25
Score
3/10