General
-
Target
1528-102-0x0000000000400000-0x0000000000615000-memory.dmp
-
Size
2.1MB
-
MD5
8c5a104b29b54f35137649af3be7a616
-
SHA1
5ad0a3f66ccaf518b2dcc0922909e48d7a00c622
-
SHA256
d3f63031c84ed700473059cd176ff2f2df3a98de5ebaeef2d089336ee73b92a8
-
SHA512
5d4eb5970507bf4db989f8ef20115993ab910da18197e3421182c8c9e2bd101d95ebc717f12937a5375929f4bb8eea67fca779c46ef7ab49ac51a1dd0c8ab4a6
-
SSDEEP
12288:o406AQY5PupeoDrQ+3JJmYZHQs4ts/ZP0tRq:86A15PupeoDrQeZHQiZA
Score
10/10
Malware Config
Extracted
Family
remcos
Botnet
RemoteHost
C2
45.82.84.10:2408
Attributes
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-ADJC7K
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
1528-102-0x0000000000400000-0x0000000000615000-memory.dmp
Headers
Sections