General
-
Target
4784-162-0x0000000000400000-0x000000000062B000-memory.dmp
-
Size
2.2MB
-
MD5
409457fd70170615b430a72b740f5783
-
SHA1
7725f660e024308cb1f74bba1680c94cf6c012fc
-
SHA256
3b82f7158d8a16ea563e1b018010c5fbd500902348b3c13f76cb69a7eaba9fd8
-
SHA512
0de4c58c6c4f7806fb480355b83f0f5458bad7d5e595e0e12d7fe10fd8c1c0814805810bc74b8d5977f9bc35eccb165b22915150ec75aa296a4b44a30dc81c6e
-
SSDEEP
12288:Ymnk7iLJbpIpiRL6I2WJKQ9ZsfZQSFn9:IiLJbpI7I2W7qZ7F9
Score
10/10
Malware Config
Extracted
Family
remcos
Botnet
DUCKDOMAIN-FILE
C2
dapsan.duckdns.org:2404
www.dapsan.biz:2404
Attributes
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
true
-
install_flag
false
-
keylog_crypt
true
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-BERTBE
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
Files
-
4784-162-0x0000000000400000-0x000000000062B000-memory.dmp
Headers
Sections