General
-
Target
1812-1264-0x0000000000400000-0x0000000000481000-memory.dmp
-
Size
516KB
-
MD5
a669d16e75bc0a475c4a7b364499dda4
-
SHA1
69aa02699e6915cd258ecf8090c57878208637e9
-
SHA256
8348a0e6edbcf9de6a42616a3d95ae6e2da8ca14e7642c93f3c60711ebf4e58a
-
SHA512
8b59db551d7b3efc7a5e5120d046133d190616639404c8989df64a47fe80c9d691d34e8507894ba832bd29d056ac114322931ad46a85a3c11b0a13e6368e8a98
-
SSDEEP
12288:ZRXxReZj3WZfj/2eSseWFaIe2+f8CL4ks/ZO2HDU:Zx7cyF2eSsewS8W4/Zj
Score
10/10
Malware Config
Extracted
Family
remcos
Botnet
RemoteHost
C2
212.193.30.230:3343
79.110.49.161:3343
Attributes
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-CQL1U6
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
1812-1264-0x0000000000400000-0x0000000000481000-memory.dmp
Headers
Sections