Overview

overview

10

Static

static

10

1736-110-0...ry.exe

windows7-x64

1

1736-110-0...ry.exe

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    1736-110-0x0000000001EB0000-0x0000000001F2E000-memory.dmp

  • Size

    504KB

  • MD5

    3df2d4517f81098c93ba400ac18c48ab

  • SHA1

    79e1de175572111cd07dcef166aefa67104da41a

  • SHA256

    74b6ea1debe18c92eb3f99597e744ffcc092d2c97d396a78156e8a80b1906f87

  • SHA512

    3a2f937d23c2bcaad6d75cb9d4a9c8aacad4ab6e45252cc3ba33223fac563d6fa17958572d3401c197eaaf0141f05cd8388b1b3a68d92b7612aefdb8edc0b6c6

  • SSDEEP

    12288:p02cJy9fGqUESRNdVNo5gtCY+AAsfZSz5N:ixE9fGjE4o5KCY+uZKH

Score
10/10
festiva-emekaremcos

Malware Config

Extracted

Family

remcos

Botnet

FESTIVA-EMEKA

C2

www.festivapherma.com:2404

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    RMC

  • mouse_option

    false

  • mutex

    Rmc-RL4E0I

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

Files

  • 1736-110-0x0000000001EB0000-0x0000000001F2E000-memory.dmp
    .exe windows x86


    Headers

    Sections