Overview

overview

10

Static

static

10

112-162-0x...ry.exe

windows7-x64

112-162-0x...ry.exe

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

  • Target

    112-162-0x0000000000A40000-0x0000000000AC0000-memory.dmp

  • Size

    512KB

  • MD5

    010c31ab8bef59a364c3b39f0b692d5c

  • SHA1

    c0c00b3a091cbabb60447ada19b0c1496718b2de

  • SHA256

    91b62aed0d92d1f477b0e8abeccb5129a59fac7b4af3c1561220ecc870b330e2

  • SHA512

    a8418d7767cba972cf845b244fcd66630eeb33bc6667fc4ab5de2385b0c40ff56db6a8a9f3dc65e20857c1ffaab424fcd6569b2918bb9f5f489325ef4b53935a

  • SSDEEP

    12288:vlHtUGUT8Vq87EOiDDKTLkM6Mnd476s/ZSIBRq:vnUjT8Vq87EOiFM9nd47BZp

Score
10/10
pele moneyremcos

Malware Config

Extracted

Family

remcos

Botnet

PELE MONEY

C2

pelerem.duckdns.org:1550

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-R4O5IZ

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

Files

  • 112-162-0x0000000000A40000-0x0000000000AC0000-memory.dmp
    .exe windows x86


    Headers

    Sections