General
-
Target
e6b91a52554e6adf43df0ffaa6b92d33.bin
-
Size
415KB
-
Sample
240628-drs1haybme
-
MD5
e7c1c3544f4fa6c40b430e2d9b4dbd6d
-
SHA1
49af3656e9c64b67ebba8c516ee569532644715e
-
SHA256
c3dd479040f9634af3679f6c935d3740c751a7dfbb81971b43ff106fa6e83148
-
SHA512
adcf90afb74a34ada7923f4f5633016d3c809700750b7114fb5fbb6eb214b4041a84cd6274b06ec88f5e0d4c6b7585c7fa13a2b6490815f670be72c19dd6c46e
-
SSDEEP
12288:+9HVnh3fg1B7OcQLgME9GczxwPgEEsoqsoPXubATq:i6HOzEVwcz6PjkovVTq
Static task
static1
Behavioral task
behavioral1
Sample
0a7f62793ce40e99600c729a97d80c02b4f8c80d16c32f5edaa8a6eac48d416e.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0a7f62793ce40e99600c729a97d80c02b4f8c80d16c32f5edaa8a6eac48d416e.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240611-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
Malware Config
Extracted
remcos
RemoteHost
204.10.160.132:2404
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-6UW0BP
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
-
Target
0a7f62793ce40e99600c729a97d80c02b4f8c80d16c32f5edaa8a6eac48d416e.exe
-
Size
428KB
-
MD5
e6b91a52554e6adf43df0ffaa6b92d33
-
SHA1
4000722ce7f9445e068892b3ed80c9151f7e8a47
-
SHA256
0a7f62793ce40e99600c729a97d80c02b4f8c80d16c32f5edaa8a6eac48d416e
-
SHA512
ea228dea9d90b67ddcea115c181fd06f07385a3497adade0f957c539cf44327259d5a1a0e36b5abb333e1c29af359743011a02c5fc1adce2e4549409d8a95ff5
-
SSDEEP
12288:0JJz/7Ecm5WQVK69G14QIlQdBnVqS2xN9wR4:CxEx5WQM69z7QVqS4oG
-
NirSoft MailPassView
Password recovery tool for various email clients
-
NirSoft WebBrowserPassView
Password recovery tool for various web browsers
-
Nirsoft
-
Loads dropped DLL
-
Accesses Microsoft Outlook accounts
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-
-
-
Target
$PLUGINSDIR/System.dll
-
Size
11KB
-
MD5
960a5c48e25cf2bca332e74e11d825c9
-
SHA1
da35c6816ace5daf4c6c1d57b93b09a82ecdc876
-
SHA256
484f8e9f194ed9016274ef3672b2c52ed5f574fb71d3884edf3c222b758a75a2
-
SHA512
cc450179e2d0d56aee2ccf8163d3882978c4e9c1aa3d3a95875fe9ba9831e07ddfd377111dc67f801fa53b6f468a418f086f1de7c71e0a5b634e1ae2a67cd3da
-
SSDEEP
192:jVL7iZJX76BiqsO7+UZEw+RlthVEoC0O3XB:g7ssOpZs/hS3X
Score3/10 -