Overview

overview

10

Static

static

10

1540-77-0x...ry.exe

windows7-x64

1

1540-77-0x...ry.exe

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    1540-77-0x0000000000400000-0x000000000047E000-memory.dmp

  • Size

    504KB

  • MD5

    d321aba595ea8efbb7139bd19f9bc8e4

  • SHA1

    c580e747bb7bac29b0b35cd9e9897e34b7660bb0

  • SHA256

    7547fad1b41e10f8c5bab876dc3cf4fab31af4c29c2f23817eae3d6fbe427d36

  • SHA512

    276aad6b3094b0893282e8f515adf0837785975875244c4c5b5f972196ae07f92941a44e8739ebd0a4403883a488505d092ab541b1588e0bb7bdaea9e82191a9

  • SSDEEP

    6144:GNzuFOjH9TX76ghtDNHffMq6+i1lSC6GocCh+41JnwNvtsAOZZYAXect:GNzuFO7V6WBN/kq9KSC6kC044sfZY

Score
10/10
hyrremcos

Malware Config

Extracted

Family

remcos

Botnet

HYR

C2

23.105.131.206:1978

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-GSSZUV

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

Files

  • 1540-77-0x0000000000400000-0x000000000047E000-memory.dmp
    .exe windows x86


    Headers

    Sections