General
-
Target
1092-61-0x00000000003D0000-0x0000000000B08000-memory.dmp
-
Size
7.2MB
-
Sample
220714-fg5bwshcg3
-
MD5
02de0e2446a00d8cdfe1f74f3cd83327
-
SHA1
248ef34024e58d3ec0888e63014c52dba77e66fa
-
SHA256
ff41966c2dd12189df52af9f62d9d6512d21b67b2ea5fe4b340cd6a8e7f2980e
-
SHA512
ec24454af5c696074cbe48676afaa5a400c581232399997554c9494e99707ac1b5797bda49a768195cd5b4bb9540a115d0b80d1afdcae8c3731dac77daf11d26
Behavioral task
behavioral1
Sample
1092-61-0x00000000003D0000-0x0000000000B08000-memory.exe
Resource
win7-20220414-en
Malware Config
Extracted
remcos
RH1
185.29.9.125:2404
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
itunes.exe
-
copy_folder
RMS
-
delete_file
true
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
true
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Jd1985-XODZWD
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Rms
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
notepad;solitaire;
Targets
-
-
Target
1092-61-0x00000000003D0000-0x0000000000B08000-memory.dmp
-
Size
7.2MB
-
MD5
02de0e2446a00d8cdfe1f74f3cd83327
-
SHA1
248ef34024e58d3ec0888e63014c52dba77e66fa
-
SHA256
ff41966c2dd12189df52af9f62d9d6512d21b67b2ea5fe4b340cd6a8e7f2980e
-
SHA512
ec24454af5c696074cbe48676afaa5a400c581232399997554c9494e99707ac1b5797bda49a768195cd5b4bb9540a115d0b80d1afdcae8c3731dac77daf11d26
-