Overview

overview

10

Static

static

10

1492-74-0x...ry.exe

windows7-x64

1492-74-0x...ry.exe

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1492-74-0x0000000000400000-0x000000000047F000-memory.dmp

  • Size

    508KB

  • MD5

    903ee7cbe4f27cff07bd3a7ddb2152db

  • SHA1

    a2023460c8300ee2191fc0e21149142dc6b129d9

  • SHA256

    fc8c2932c4421004972cb5933118f461a47628c27ac3d348f03bbf59e86cf999

  • SHA512

    31bc72dc4c27bfa34dc8bb8f0292b4f17683c5941fb1059b01dcd8734b1b53da8612f2f7dfb63b1a24d6e83b3287457adc500143309563345c61838d6a03f2db

  • SSDEEP

    6144:uAg4RVDZlHx5k7iLZnaSguI2IiRL/SISjw8nHWh1R2K3g9ZsAOZZQmXxlcK:umnk7iLJbpIpiRL6I2WhSKQ9ZsfZQS

Score
10/10
2nd-hostremcos

Malware Config

Extracted

Family

remcos

Botnet

2nd-Host

C2

eaidali101.ddns.net:6060

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    true

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-3DZ9AY

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

Files

  • 1492-74-0x0000000000400000-0x000000000047F000-memory.dmp
    .exe windows x86


    Headers

    Sections