General
-
Target
572-114-0x0000000002350000-0x00000000023D1000-memory.dmp
-
Size
516KB
-
MD5
67eaee8397d275b81993d6413ed8b420
-
SHA1
5f7b0c3f51a9c38748efe6b820a73fa1fa8e1f0c
-
SHA256
e6939cab9c386ce7d9b44539035eaee9a7a2d62731f37af25733cf8136c6910a
-
SHA512
7dc0e0f949169d1c20459cf5a19fbeac2421678342163fa4c095d7158cb3e031d9d9064df1f0cdf08a7817727d9b39769cc43c06065ee69f211b1bb9f76cf240
-
SSDEEP
12288:UfcEbQJ+LeHcDvEhm6LFMN74sCSxbxbHSrbkWO+Ss/ZDbryDU:U2Ae8jGLqN74dKSr4WO+ZZXr
Malware Config
Extracted
remcos
YAK BACK
79.110.63.178:8974
plunder.jumpingcrab.com:8974
plunder.dynnamn.ru:8974
plunder.duckdns.org:8974
plunder.dedyn.io:8974
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
IUYTRSXCGHJKJYTR34567-VLBW2Y
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
572-114-0x0000000002350000-0x00000000023D1000-memory.dmp
Headers
Sections