General

  • Target

    1080-67-0x0000000000400000-0x0000000000481000-memory.dmp

  • Size

    516KB

  • Sample

    230608-m4gyfaee87

  • MD5

    58b40a60c0323376fa0c3a1f5641316b

  • SHA1

    f654507a30a2b7d8e23ea70d1a9fc758603b6bad

  • SHA256

    d07291dc6fa0b5d02e1dc10004fdfb23a6d2766c44da4c55cf53fcc77c794931

  • SHA512

    21c9db18496f386a963f3e548dfc48397b0b4df9ba03d6d76f2d938c97e78be2df4f6f0919cfb7882b8ff715e3833d6fe224d188c17bd2646f1c3f9164bc59cb

  • SSDEEP

    6144:b1EwL0xQk9VdeLuVnQs8QLgt8cBvnkCX/3Rde+A+DdsAOZZ0XX7cN:b1EZT90uNQzYgScBvnn/XpTs/Z0

Score
10/10

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

157.90.206.40:2404

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-RXCS6P

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      1080-67-0x0000000000400000-0x0000000000481000-memory.dmp

    • Size

      516KB

    • MD5

      58b40a60c0323376fa0c3a1f5641316b

    • SHA1

      f654507a30a2b7d8e23ea70d1a9fc758603b6bad

    • SHA256

      d07291dc6fa0b5d02e1dc10004fdfb23a6d2766c44da4c55cf53fcc77c794931

    • SHA512

      21c9db18496f386a963f3e548dfc48397b0b4df9ba03d6d76f2d938c97e78be2df4f6f0919cfb7882b8ff715e3833d6fe224d188c17bd2646f1c3f9164bc59cb

    • SSDEEP

      6144:b1EwL0xQk9VdeLuVnQs8QLgt8cBvnkCX/3Rde+A+DdsAOZZ0XX7cN:b1EZT90uNQzYgScBvnn/XpTs/Z0

    Score
    1/10

MITRE ATT&CK Matrix

Tasks