General
-
Target
1412-10637-0x0000000000400000-0x0000000000480000-memory.dmp
-
Size
512KB
-
MD5
d6edacc43751a3aaae2c82f1947cbd4d
-
SHA1
36b02ac744ef0d9d3692b2efab7cbbc44b079449
-
SHA256
a0475aab15ef287744537f10bc71f8058f15799ca7c05da2f4f1750031ded11b
-
SHA512
d3058cd247083bb7a1259da7f07efe21c9809551db68d1cc82c0b08214e35fbff85698e5e345c8b55f16779ec3151e71e8e377d4361fda67899e64888dcbe81b
-
SSDEEP
12288:E406AQY5PupeoDrQ+3JJmYZHQ7s/ZPUtRq:A6A15PupeoDrQeZHQ+ZQ
Score
10/10
Malware Config
Extracted
Family
remcos
Botnet
2023 gee Host
C2
davidwong4ghost.ddnsking.com:2030
Attributes
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
wuauclt.exe
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
true
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Rmc-XYQJVL
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
chrome
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
1412-10637-0x0000000000400000-0x0000000000480000-memory.dmp
Headers
Sections