General
-
Target
2752-148-0x0000000000400000-0x0000000000480000-memory.dmp
-
Size
512KB
-
MD5
4deae6ffeb7173fee2638a48c81a3fb3
-
SHA1
2190b733a19e122f4b39726409d72d39f1c6a018
-
SHA256
ad2e99f290a2a9d67a03208cabc82548f86a630d45db491d8c372e678edebb41
-
SHA512
0edcd77b539a194d6030d5f4c26029cfe487fc174a467045e34f2bafa21a39aca4bc9b756427140d950fa1d10a910084403128af97d6d63719c9ec046ced430f
-
SSDEEP
12288:yX8/Vx65HCnDAByqulR1fZJQGs/Z8eRq:Z/Vc5HCnDABMfZJQNZF
Score
10/10
Malware Config
Extracted
Family
remcos
Botnet
RemoteHost
C2
45.139.105.174:2210
212.193.30.230:6320
212.193.30.230:2286
212.193.30.230:3330
Attributes
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
Date.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
true
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-PQ59ZA
-
screenshot_crypt
false
-
screenshot_flag
true
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
1
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
2752-148-0x0000000000400000-0x0000000000480000-memory.dmp
Headers
Sections