General
-
Target
1620-80-0x0000000000400000-0x0000000000480000-memory.dmp
-
Size
512KB
-
MD5
7c03cde73440337403be85b986a2f1e9
-
SHA1
dbb5b09b2398664ade2de42292608fa2126cb902
-
SHA256
4412ccda37a28b8b79d2e341fe93a0cc8953b77afd6d4e45d74a492ebd2a9711
-
SHA512
d108644286077e2663c6ee606c4ff3ad30e658f426ff204524ee26819f4693cb06c71ba9595fc3207b2da1e14c057181adc91327c25f60ec07baa03775c27b19
-
SSDEEP
6144:U43E0RO2xAQTC55PIzpVzi3ORDZZQMBt3JJmIGwZHEfcidC48h47QksAOZZPRXMg:U406AQY5PupeoDrQ+3JJmYZHQJs/ZP
Score
10/10
Malware Config
Extracted
Family
remcos
Botnet
RemoteHost
C2
212.193.30.230:3330
Attributes
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
true
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-VPI7TY
-
screenshot_crypt
false
-
screenshot_flag
true
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
1
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
Files
-
1620-80-0x0000000000400000-0x0000000000480000-memory.dmp
Headers
Sections