General
-
Target
2676-14-0x0000000072870000-0x00000000738D2000-memory.dmp
-
Size
16.4MB
-
MD5
df465930095be2b81404634de703ed80
-
SHA1
e3a52a0b430372a80dc0c73fc3e820825be603f8
-
SHA256
311409f857075d595538540a970011aa7791ba0134dbfbd8fbabf31864dbeb00
-
SHA512
f95afef457e0dabe5d6af9f7e424889737bdf033ea81de321f0eb80980c1bc6d19e2ad7dd9ddd24c86b5bd5f4bfa8c65334291973e75fcf89fdad2e3bd464ea9
-
SSDEEP
12288:93YojeH0NCRkwN27p8com3N/h8t9Wvs/ZGyw2DU:9IOeY8N27p8/TtISZM
Score
10/10
Malware Config
Extracted
Family
remcos
Botnet
RemoteHost
C2
205.234.181.73:2404
Attributes
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-RHAGV7
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
2676-14-0x0000000072870000-0x00000000738D2000-memory.dmp
Headers
Sections