General
-
Target
1892-72-0x0000000000400000-0x0000000000615000-memory.dmp
-
Size
2.1MB
-
MD5
bb0d9f2ff0b940855c935a1d3872f241
-
SHA1
f58f17f8b058cd1f2669b420482b5d09fbb092df
-
SHA256
c75096a25f36b31779bb98ab07667f925b2fca5c2ee47878ff47229c7b1ea3a8
-
SHA512
c64aabc4b0d1ee58994f04360a3745aacd9e0b8b15afbd9ce2b5a0226433878434868d9f76b4bcc77f289f11b402771a2435d1f8a5c12dfc0142bc3b4113dc91
-
SSDEEP
6144:31EwL0xQk9VdeLuVnQs8QLgt8cBvnkCX/3Rde+A+DVsAOZZRXXrcNI2OhX:31EZT90uNQzYgScBvnn/XpTs/ZRsOhX
Score
10/10
Malware Config
Extracted
Family
remcos
Botnet
Awelle-Host
C2
gdyhjjdhbvxgsfe.gotdns.ch:2718
Attributes
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
true
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Rmc-W62KZF
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
1892-72-0x0000000000400000-0x0000000000615000-memory.dmp
Headers
Sections