General
-
Target
764-172-0x0000000000400000-0x0000000000480000-memory.dmp
-
Size
512KB
-
MD5
2ee5bec25ab88112d9352c4f308fbec8
-
SHA1
1f93245985b236bc41be9b1d0ec4efef0791ee47
-
SHA256
2770ea2e34adf7770966d355e3d100fa900caf1342eaf7cac59141580d64bcd7
-
SHA512
01fa0b799f1f8b4e55d87d3663fd13360a1a80d7a8ec1d84981efdf21302d6900d4d0ff7d99f4d6b37db0de360ae448ce57a33e0d8516643f58e46fb68985399
-
SSDEEP
12288:o406AQY5PupeoDrQ+3JJmYZHQJs/ZPvtRq:86A15PupeoDrQeZHQoZP
Score
10/10
Malware Config
Extracted
Family
remcos
Botnet
MiloJueves3
C2
contificoseguro.con-ip.com:2500
Attributes
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
true
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logslmilo.dat
-
keylog_flag
false
-
keylog_folder
logslivemilo3
-
mouse_option
false
-
mutex
Rmcau1milo1243-GYYUP2
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
764-172-0x0000000000400000-0x0000000000480000-memory.dmp
Headers
Sections