Overview

overview

10

Static

static

10

108-75-0x0...ry.exe

windows7-x64

1

108-75-0x0...ry.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    108-75-0x0000000000400000-0x0000000000480000-memory.dmp

  • Size

    512KB

  • MD5

    e7f9c2412510d29af80f0a22be014c2a

  • SHA1

    d443de0d7e8bfa7aea3308c7b66d909b017241de

  • SHA256

    d49c6b265e3c4d368e5e53daafa3e3d9ef11a7ab3400f2e5f2e4c50137c463c0

  • SHA512

    908ffe6b1fb73318842d5a1d5b8d3c5a4430fdc968fff1af0272e3d932d14dd8e17133f6bbd7cc2d498f84a25743daca92c2a2235984a2a31a250c91707048b4

  • SSDEEP

    6144:Y43E0RO2xAQTC55PIzpVzi3ORDZZQMBt3JJmIGwZHEfcidC48h47QksAOZZPRXMT:Y406AQY5PupeoDrQ+3JJmYZHQJs/ZP

Score
10/10
54321remcos

Malware Config

Extracted

Family

remcos

Botnet

54321

C2

45.88.66.122:54321

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    kbkguyub-28XZUN

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

Files

  • 108-75-0x0000000000400000-0x0000000000480000-memory.dmp
    .exe windows x86


    Headers

    Sections