General

  • Target

    780-70-0x0000000000400000-0x000000000047E000-memory.dmp

  • Size

    504KB

  • MD5

    c0b67d72dae3e82c276273a59e55c062

  • SHA1

    3440e8b5a6b3f447ffb5d8c1546eaa6383516fe3

  • SHA256

    e08e7fdb52da0b24b5e0eb3d52d51d0e32484c3072f3d000a7a517b26cae794b

  • SHA512

    afc71d17033aad4767dc4aae262b5279f5504db08dd6e9772039e25c741f13b2481ff3fcc94eec8b42721d19f1782cef23281fb750bef762ea9afe1b35b3eb7a

  • SSDEEP

    6144:gNzuFOjH9TX76ghtDNHffMq6+i1lSC6GocCh+41JnwNvtsAOZZYAXect:gNzuFO7V6WBN/kq9KSC6kC044sfZY

Score
10/10

Malware Config

Extracted

Family

remcos

Botnet

BALLER

C2

91.192.100.48:1979

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-2RPM8Z

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

Files

  • 780-70-0x0000000000400000-0x000000000047E000-memory.dmp
    .exe windows x86


    Headers

    Sections