Overview

overview

10

Static

static

10

1748-145-0...ry.exe

windows7-x64

1748-145-0...ry.exe

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

  • Target

    1748-145-0x0000000000400000-0x0000000000615000-memory.dmp

  • Size

    2.1MB

  • MD5

    90874c5a6e0b6b3b2bf1a30f1e7593bd

  • SHA1

    cd3e2fbee3c52572c12328b842dacf9a6222d898

  • SHA256

    81d6249ef13fe660f855f286bb74850743a6d32b393b15a5f1f2a51827f27e63

  • SHA512

    bc3056ab30cff8c60f478f309b2b0bb78be63ab8b95f3e85e1ec91cc4c1701939c18b5f1110f4fe3ae621b1440dc6543944ce259f7d52189a3a3b53d587fb557

  • SSDEEP

    12288:JjdAK8wxqkXuxOqLXO3X2orpbTs/ZgEBRq:XA3wxqkXuxOq+rpbWZX

Score
10/10
remotehostremcos

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

185.246.220.53:50434

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-7DBJAM

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

Files

  • 1748-145-0x0000000000400000-0x0000000000615000-memory.dmp
    .exe windows x86


    Headers

    Sections