Overview

overview

10

Static

static

10

1748-73-0x...ry.exe

windows7-x64

1748-73-0x...ry.exe

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1748-73-0x0000000000430000-0x00000000009CE000-memory.dmp

  • Size

    5.6MB

  • MD5

    a3f5471af7730a798c7c0a07725a5aa5

  • SHA1

    65ba7262c4e57bfe0d63bd62d2ba52d0964f2297

  • SHA256

    8988d2df97e3b79cc14ea00832699f922bb514aafeaa5e7b31ab5401b8bb0d0b

  • SHA512

    c19bf0f8d6eb90376aec03488bd49a289884a5ef1657baa3add23720169601cb77fc6c9e5c09dd76025761258da8e91d7bcfdb6059a411367cdd3b7ffd9e6ef8

  • SSDEEP

    12288:KjnesN86LrrGme3ALK7km/kS82hs/ZX9Rq:mHN3LrrGmeQ5S8fZP

Score
10/10
remotehostremcos

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

185.246.220.63:3689

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-7SGYUR

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

Files

  • 1748-73-0x0000000000430000-0x00000000009CE000-memory.dmp
    .exe windows x86


    Headers

    Sections