General
- Target file.exe
- Size 1.2MB
- Sample260730-v232wswzes
- SHA256 e5bccb979fef3945c64622c6ad4461947eca123465f2989d9f4af879fd467890
Score
10/10
Malware Config
Extracted
Family
-
remcos
Version
-
7.2.6 Pro
Botnet
-
lods132
C2
-
58.96.75.176:15151
Attributes
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
75
-
connect_interval
7
-
copy_file
microsip.exe
-
copy_folder
9qcn.tmp
-
delete_file
true
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
true
-
install_path
%AppData%
-
keylog_crypt
true
-
keylog_file
libdat.d
-
keylog_flag
false
-
keylog_folder
libTlgprod
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
66389GGR1R-JWD72O
-
screenshot_crypt
true
-
screenshot_flag
false
-
screenshot_folder
9qsem.tmp
-
screenshot_path
%Temp%
-
screenshot_time
10
- startup_value
-
take_screenshot_option
true
-
take_screenshot_time
8
-
take_screenshot_title
seed;PayPal;Login;Bank;Crypto;Coin;2FA;private;phrase;pnemonic;wallet;
Targets
-
- Target file.exe
- Size 1.2MB
- SHA256 e5bccb979fef3945c64622c6ad4461947eca123465f2989d9f4af879fd467890
Score10/10-
Family: Remcos
Remcos is a closed-source remote control and surveillance software.
-
Adds policy Run key to start application
-
Deletes itself
-
Executes dropped EXE
-
Adds Run key to start application
-
Suspicious use of SetThreadContext