General
-
Target
848-58-0x0000000000400000-0x000000000047F000-memory.dmp
-
Size
508KB
-
Sample
221209-kstfzscg44
-
MD5
0f0aa73c902f422627a1436460be3fb5
-
SHA1
02da24f91ce6ff05888c5e07428df7843c5c5a00
-
SHA256
c8d9ec769e0d667e516effcb7f7bb9b709b7ab850380e49acb65c30358846ac1
-
SHA512
c172d876d27a5b065b3c9a4458729795565e78ff61e98b6c4e4c4378b48390151ce68163cc8af930b7a71ee215512cdfb39879575a4b4a375adaf1e349e398b9
-
SSDEEP
12288:Htmox/Sl5vkKtAXjsoZ8wHonsfZgj64x:NmW6l5vkKtAD8wIKZE
Behavioral task
behavioral1
Sample
848-58-0x0000000000400000-0x000000000047F000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
848-58-0x0000000000400000-0x000000000047F000-memory.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
remcos
sunshine
sunshine08.ddns.net:5687
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-BQS99W
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
-
Target
848-58-0x0000000000400000-0x000000000047F000-memory.dmp
-
Size
508KB
-
MD5
0f0aa73c902f422627a1436460be3fb5
-
SHA1
02da24f91ce6ff05888c5e07428df7843c5c5a00
-
SHA256
c8d9ec769e0d667e516effcb7f7bb9b709b7ab850380e49acb65c30358846ac1
-
SHA512
c172d876d27a5b065b3c9a4458729795565e78ff61e98b6c4e4c4378b48390151ce68163cc8af930b7a71ee215512cdfb39879575a4b4a375adaf1e349e398b9
-
SSDEEP
12288:Htmox/Sl5vkKtAXjsoZ8wHonsfZgj64x:NmW6l5vkKtAD8wIKZE
Score1/10 -