General
-
Target
2040-56-0x0000000000400000-0x00000000004D1000-memory.dmp
-
Size
836KB
-
MD5
f1fedf0bf89821bc8c837089db7be4ff
-
SHA1
ba171c0d4b984494d1170c50c417a25ff6a6d2e9
-
SHA256
c36da201cacb834d87060cdffeb29a49cc93daa55fb5e255a03319411e71a5d0
-
SHA512
d91ffb87d804224534b9f218ce8a6967a8af934c554c2d82836f98db5ac2ebea30c892e355dd061311d963c8ccbe6ce400e4a70c53a0b23607d21996ee3c55d6
-
SSDEEP
12288:cqYktkO4cpK4KoK6i/f7rQSAp3NFJORw9oYIwn1qwRYR/LQqbmwz:hte2K4vAQTBVCw9DIw1i9Eqbmwz
Score
10/10
Malware Config
Extracted
Family
remcos
Version
4.7.0 Light
Botnet
RemoteHost
C2
80.66.75.129:3719
Attributes
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
10
-
connect_interval
2
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-NQTCEM
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
2040-56-0x0000000000400000-0x00000000004D1000-memory.dmp
Headers
Sections