General
-
Target
1900-104-0x0000000000400000-0x0000000000615000-memory.dmp
-
Size
2.1MB
-
MD5
cfff550568085a656aa2381389c120c5
-
SHA1
1d7ab1a440082e751552c47bfbb4b9ab5647f2a3
-
SHA256
117675bd650d1f551498ac87f81ec7885db788e15337162de0e2a71cb3ccdede
-
SHA512
f1e0582d8b5e4b32a9bd7345718c01d2fef1c5447a09b42b440b28a2e25fef712b98868a933d75bd16b24b89247e7f8c7fb9334e76c99a612ef12421af73162f
-
SSDEEP
12288:o406AQY5PupeoDrQ+3JJmYZHQUs/ZP0tRq:86A15PupeoDrQeZHQvZA
Score
10/10
Malware Config
Extracted
Family
remcos
Botnet
RemoteHost
C2
45.82.84.10:2408
Attributes
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-ADJC7K
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
1900-104-0x0000000000400000-0x0000000000615000-memory.dmp
Headers
Sections