Overview

overview

10

Static

static

10

1808-196-0...ry.exe

windows7-x64

1

1808-196-0...ry.exe

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    1808-196-0x0000000000630000-0x00000000006B0000-memory.dmp

  • Size

    512KB

  • MD5

    cb7b99a2c6231b648910757a9a2d230b

  • SHA1

    67e4fd0bb215685d31f23d25954bce8ab3295bcd

  • SHA256

    c3e7b3cae135e0254c164ef7cb5560b145c351b3d7c46c6f9bf14fb19a3bc17c

  • SHA512

    34468a76f16fd6b08d72fc3f8db55a5829719bb250693218db2cf2c6e018d5fb4d6790e0671773dc0a16828c4dfe6573650f4285c2a582386b50f5043dbb854d

  • SSDEEP

    12288:I2XK77td7/btlZakxjL1rG8Hes/ZTQERq:VK77DbtlZake8HlZT/

Score
10/10
destiny differsremcos

Malware Config

Extracted

Family

remcos

Botnet

DESTINY DIFFERS

C2

ekurorem.duckdns.org:1979

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-X77K34

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

Files

  • 1808-196-0x0000000000630000-0x00000000006B0000-memory.dmp
    .exe windows x86


    Headers

    Sections