General
-
Target
572-281-0x0000000000400000-0x0000000001462000-memory.dmp
-
Size
16.4MB
-
MD5
d63e7c1bb533a8bca11e05a324125ea8
-
SHA1
8cca71302a16974c97cb41cf7d5eb49d54fe7888
-
SHA256
b3d50da0a68abf2e446b7abcb54aede0d46346affa0ab5c7efbfb21460cc1052
-
SHA512
39e9bbff3e9fec8834c1eb39f9d49fc4b58fda958666ee8a17e8115cf428068448d665797696a6e1364a0327d306a0bec2c2b0f9b0d82cd2f0caf4e2bcbfd0ba
-
SSDEEP
12288:4406AQY5PupeoDrQ+3JJmYZHQJs/ZPBtRq:s6A15PupeoDrQeZHQoZh
Score
10/10
Malware Config
Extracted
Family
remcos
Botnet
RemoteHost
C2
193.25.214.194:2404
Attributes
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-U9J1PA
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
572-281-0x0000000000400000-0x0000000001462000-memory.dmp
Headers
Sections