General
-
Target
1328-163-0x0000000000640000-0x00000000006BF000-memory.dmp
-
Size
508KB
-
MD5
556eaf4707fe38ac481ff77d0450ca83
-
SHA1
8de4660e443c6510a4015fb0a52c690f1c4ef51d
-
SHA256
1ee20c70426edb8df1dab9c4f919935df602056e6a43ad93e64fc7667965fc98
-
SHA512
f4aae88ffcdb6d1dcd2354357f2697dca0c781e21991d83db5a42f79de03844f7b7c2b142cd6bbd47849e7dbafcaa1fe95c57dad6cc605b14a1357081befd458
-
SSDEEP
6144:41mHSRSmP0kbktyNV67P00HZ5eOe9/KfYflKcIrwsAOZZ7NXBcvD4:OvFZbktE4r00DeOe9KA9sfZ784
Score
10/10
Malware Config
Extracted
Family
remcos
Botnet
SKY-YAK
C2
www.christopherferr.com:2404
Attributes
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
12345
-
mouse_option
false
-
mutex
Rmc-E68T3F
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
Files
-
1328-163-0x0000000000640000-0x00000000006BF000-memory.dmp
Headers
Sections