General
-
Target
1740-2-0x0000000000400000-0x0000000000533000-memory.dmp
-
Size
1.2MB
-
MD5
d39c00ec6444d0814a744ae62bd444c0
-
SHA1
53beee34b59c8bab1507b3b4ded2e6e5b26693b5
-
SHA256
1ee363f532cf028ad7c68911a85b121337119760841c6b675ea97058c9f98b38
-
SHA512
c879a77046503f0a7ed96c193f972aa1b5a8c19297bc832ccf55d77b9199496f45e5d02706d771c05df42732ac216fe2ffc6d2332b8bcba184c430b1ea45a853
-
SSDEEP
24576:vx7cyF2eSsewS8W4sZOjwqqVn8EvDC5Gk2D9f:Zu+S8HsZL8EGc
Score
10/10
Malware Config
Extracted
Family
remcos
Botnet
27009
C2
212.23.211.238:27009
Attributes
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
0x000000000.iep
-
keylog_flag
false
-
keylog_folder
Systeminfo
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
EGiy6hf-YWJYTZ
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
notepad;solitaire;
Signatures
-
Remcos family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
1740-2-0x0000000000400000-0x0000000000533000-memory.dmp
Headers
Sections