General
-
Target
2016-203-0x0000000000400000-0x0000000001462000-memory.dmp
-
Size
16.4MB
-
MD5
f142083e99c413533da1b743836d9148
-
SHA1
531fad26b30d85a6a32b359e9ce2aa8c2c70ba31
-
SHA256
736043b8a7f7cedd565c81ca53229f51fd6dda51e874117757acf6c4343c6b96
-
SHA512
6e0f0681f51c5ff2852e594e6091d155da73b2a14a4c5686ec935224829f4fab25515f719dd85bc3181e23098d0111c8271c528ca7b1b6a3358e86eeb6277112
-
SSDEEP
12288:31EZT90uNQzYgScBvnn/Xpks/ZRbpOhX:FcTiuazYgr/Xp/ZfK
Score
10/10
Malware Config
Extracted
Family
remcos
Botnet
RemoteHost
C2
divdemoce.duckdns.org:35639
Attributes
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
dtas.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Rmc-GZATCK
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
2016-203-0x0000000000400000-0x0000000001462000-memory.dmp
Headers
Sections