General
-
Target
3624-149-0x00000000036E0000-0x000000000375C000-memory.dmp
-
Size
496KB
-
MD5
51648597e73a3634c97d0c00c99a1ab5
-
SHA1
ab035e605d214577db6a81871fe2625da35578e4
-
SHA256
cec6baef4a0dcb3ff2abe34917278ee68b4656cad49c07d05d304a5566ca1e0f
-
SHA512
31ec76eaa8ad0856da9f5073e4439613e6281b905a979897fe2d3435c76ad0934d67579239410185f8bf8f5c2e513190be6ae506d2c36aa3e03453e16dcae381
-
SSDEEP
6144:hXVUvr+eNVx6JuGD5To83sRnymABKtqulRwOJfZJEfcZdC48hA6TWsAOZZ8RX7mT:hX8/Vx65HCnDAByqulR1fZJQ3ys/Z8
Score
10/10
Malware Config
Extracted
Family
remcos
Botnet
RemoteHost
C2
top.never01abuse.xyz:4186
Attributes
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmcoss-AS3COA
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
Files
-
3624-149-0x00000000036E0000-0x000000000375C000-memory.dmp
Headers
Sections