Overview

overview

10

Static

static

10

32-143-0x0...ry.exe

windows7-x64

32-143-0x0...ry.exe

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

  • Target

    32-143-0x0000000000400000-0x0000000000480000-memory.dmp

  • Size

    512KB

  • MD5

    d568c515509eccaaad49ddb9fe0695cd

  • SHA1

    09396a7adabc4e3e531e93a10acbb27396c3bbf8

  • SHA256

    15cbe927092c2cc18e656ecf1cfea4f3b8af38f67b3f6344fd5a06af40e061b2

  • SHA512

    53c258f2b7b3e0573798c05c36bccf8af013702a93e18e6c8c70a3e3ccb10539b72519fa643819c04a89c0a6ef5e7f01ea9124c65ebfea3d36c2ecae8548333d

  • SSDEEP

    12288:pjdAK8wxqkXuxOqLXO3X2orpbKs/Z6LBRq:3A3wxqkXuxOq+rpbRZ2

Score
10/10
remotehostremcos

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

185.189.112.27:30544

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-C12GMX

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

Files

  • 32-143-0x0000000000400000-0x0000000000480000-memory.dmp
    .exe windows x86


    Headers

    Sections