Overview

overview

10

Static

static

10

1488-67-0x...ry.exe

windows7-x64

1

1488-67-0x...ry.exe

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    1488-67-0x0000000000400000-0x000000000047B000-memory.dmp

  • Size

    492KB

  • MD5

    83074534cf92ce136043e359c235014d

  • SHA1

    5c7145a695302ce687ed901c3d0ab6a800282767

  • SHA256

    9257b9040c199e6bcd4c5ba7a37666ef9217f12ee1072eb80a557b7f0dba31e4

  • SHA512

    6c1aa6f95852cb1c03645f01089354c2551009c5d58bbce36cd2ce7bd991ff85367969280e7e372e563a3a326ce5f3aea8967e70cd2f3df884f9036f0052d455

  • SSDEEP

    12288:EsrjeS3UVprYfELtx6uz6s3x4KsfZVFtS6d:xHeaUVxYVuzB3QZ70a

Score
10/10
xp_no startupremcos

Malware Config

Extracted

Family

remcos

Botnet

Xp_no startup

C2

xpremcuz300622.ddns.net:3542

Attributes
  • audio_folder

    MicRecords

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • install_path

    %AppData%

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    Remcos-419DY7

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

Files

  • 1488-67-0x0000000000400000-0x000000000047B000-memory.dmp
    .exe windows x86


    Headers

    Sections