General
-
Target
4452-1291-0x0000000000400000-0x0000000000481000-memory.dmp
-
Size
516KB
-
MD5
235188a92ef831b0dd9af419cf91be11
-
SHA1
47f10d26786a14add676c3c683e6350b6ab87692
-
SHA256
f1930c1a1af9f9b640362cdde1a9e199082a793e2124f87ec290c50c24b5aaf6
-
SHA512
ca0732402f6b99575d11323f94b3e6c165fd8b370cf39b54e7735774f8e868dc8e2f0fb4f9fc668cbdda04eb156a1139e8dcb5ab88e07fd7412490d03b381656
-
SSDEEP
12288:iRXxReZj3WZfj/2eSseWFaIe2+f8CL40s/ZiK5DU:ix7cyF2eSsewS8W4PZD
Score
10/10
Malware Config
Extracted
Family
remcos
Botnet
RemoteHost
C2
194.147.140.213:11011
Attributes
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-ZR3YYX
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
4452-1291-0x0000000000400000-0x0000000000481000-memory.dmp
Headers
Sections