General
-
Target
2636-49-0x000000000A750000-0x000000000A7D2000-memory.dmp
-
Size
520KB
-
MD5
bce7da382f37149a0b0c612cae6ea711
-
SHA1
389cb5402bf48cdb8d338d5d50ff236a32379731
-
SHA256
9d1487be1e40f42d4cdb3a74eed6de1f4a4919896567c1b63c365a1a6cc576c1
-
SHA512
bd9b1f72318c71da9dc6ff459ae0bf274621fe438b8fc3245a0d24435c5e2b9cb6431411630edbf11d3c86ad3516d7ce0740e4e5da6a51d8205cb78d001149c2
-
SSDEEP
12288:d/pYAxwT12g+i0Ah43/1WrF+YV/s/ZxXbv:Yp2g+i0rWrFlViZ
Score
10/10
Malware Config
Extracted
Family
remcos
Botnet
RemoteHost
C2
127.0.0.1:43991
127.0.0.1:42199
163.123.143.32:42199
163.123.143.32:43991
Attributes
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-R5D89Y
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
2636-49-0x000000000A750000-0x000000000A7D2000-memory.dmp
Headers
Sections