General
- Target 2026-11-10_f350a61c91639c90a750ae568e9cacfa_elex_remcos_remocs_wannacry
- Size 96KB
- Sample261111-s1ea2aht5p
- SHA256 306aa70bb6350e66f35e2681970c49945342fb0c956b94c934a07b722d89de10
Score
10/10
Malware Config
Extracted
Family
-
remcos
Version
-
1.7 Pro
Botnet
-
Host
C2
-
rr887.live:443
-
x8888.org:443
-
rr88.chinhthuc001.site:443
-
chinhthuc001.site:443
-
chinhthuc68688.site:443
-
rr88z.chinhthuc68688.site:443
-
8rpofficial.com:443
-
rr889.online:443
-
xxx88.biz:443
-
m.warstories.cc:443
-
warstories.cc:443
-
xx8888.org:443
-
en.edushu.co:443
-
blog.freehostup.net:443
-
fssaonline.in:443
-
u888vnd.com:443
-
cms.muamala.cloud:443
-
muamala.cloud:443
-
baiviet.alo24h.net:443
-
llwin.africa:443
Attributes
-
audio_folder
audio
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
5
-
copy_file
remcos.exe
-
copy_folder
remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
remcos_guhzpsdqcsnupnl
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screens
-
screenshot_path
%AppData%
-
screenshot_time
1
-
startup_value
remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
- Target 2026-11-10_f350a61c91639c90a750ae568e9cacfa_elex_remcos_remocs_wannacry
- Size 96KB
- SHA256 306aa70bb6350e66f35e2681970c49945342fb0c956b94c934a07b722d89de10
Score3/10