General
-
Target
568-56-0x0000000026910000-0x0000000026992000-memory.dmp
-
Size
520KB
-
MD5
fb2a271d65e1097da50ab64f3738adbb
-
SHA1
91d144fc3b866179e28156bc5eab773c3d5cd9d9
-
SHA256
4dbae4c3f42346cae43dfe9304be644d7a39270280a4c4ba5ac752966646639e
-
SHA512
1056ccee4ec8602475428f777c16972f92abb16f6316aafe0e4a97068a26bb6b67fa4d49b11f9bc61ecff8f120d055799f31d5189f570f007452941baedfa098
-
SSDEEP
12288:RfpwGE4BQMAOQui0A5Q3nN2TDigs/Zp8bv:PEJOQui0L2TEZ
Score
10/10
Malware Config
Extracted
Family
remcos
Botnet
ES
C2
tornado.ydns.eu:1972
orifak.ydns.eu:1972
Attributes
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
RmEEESSSssss-4VQ5KE
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
568-56-0x0000000026910000-0x0000000026992000-memory.dmp
Headers
Sections