Overview

overview

10

Static

static

10

4184-145-0...ry.exe

windows7-x64

1

4184-145-0...ry.exe

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    4184-145-0x0000000000400000-0x000000000047B000-memory.dmp

  • Size

    492KB

  • MD5

    0d58f8375d7b8f160ed10794598c5199

  • SHA1

    89a2fa030a1cd1e0f28aa0671d577aa7407d849e

  • SHA256

    adf329b0ec15a8c23e6c2bcd76cf54b5031921d64a6cb70da70f094adb5a0400

  • SHA512

    5153da199e28d415b75d3adb07afd82c537e5953d11804f29d6c811c0415ae70c0aa15b5dc58ddbc8bef9aeac5ebf6b419b98fefa7d0135fd378683feed89ba4

  • SSDEEP

    12288:CsrjeS3UVprYfELtx6uz6s3Q4KsfZVCtS6d:3HeaUVxYVuzB3hZ00a

Score
10/10
faithremcos

Malware Config

Extracted

Family

remcos

Botnet

FAITH

C2

185.206.225.51:18853

127.0.0.1:18853

10.16.225.165:18853
Attributes
  • audio_folder

    MicRecords

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • install_path

    %AppData%

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    Remcos-QQ9K6X

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

Files

  • 4184-145-0x0000000000400000-0x000000000047B000-memory.dmp
    .exe windows x86


    Headers

    Sections