Overview

overview

10

Static

static

10

824-87-0x0...ry.exe

windows7-x64

824-87-0x0...ry.exe

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

  • Target

    824-87-0x0000000000400000-0x0000000000480000-memory.dmp

  • Size

    512KB

  • MD5

    9ff6d23b8de79e0a8fbcef597e630c39

  • SHA1

    c7cd8a90386de3b810df6f57b3b3d8a4b35ccedc

  • SHA256

    cf6ed02ebed6abad5af9d1d7d13a7156b3f7980c47ac718619e95fd11bf9d109

  • SHA512

    cabd7fea20a3a76ec3b1461e062fcd7dcb5e10386be130c688419972eeb967225756ffb0a14fab673136350c40eec39c9d5c10ea5e1719baae22a509fc56bd34

  • SSDEEP

    6144:mGqPd7rxgdfHD0Tnt5eh+4CwineHvWyBKxrw/5ttwAMS6NZ0sAOZZ7QX3cUyRq:mGAxQj0bTe04CLneHvW9rwbxs/Z7fRq

Score
10/10
first-sendremcos

Malware Config

Extracted

Family

remcos

Botnet

First-Send

C2

top.not4abuse1.xyz:1558

sub.not4abuse1.xyz:1558
Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    true

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    rmcs

  • mouse_option

    false

  • mutex

    Rmc-4RNJ4J

  • screenshot_crypt

    false

  • screenshot_flag

    true

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    20

  • startup_value

    Remcos

  • take_screenshot_option

    true

  • take_screenshot_time

    5

  • take_screenshot_title

    Mail;Payment;Bank

Signatures

Files

  • 824-87-0x0000000000400000-0x0000000000480000-memory.dmp
    .exe windows x86


    Headers

    Sections