General
-
Target
2984-15-0x0000000072FF0000-0x0000000074052000-memory.dmp
-
Size
16.4MB
-
MD5
ae8b80a91d7e110930faf0879965a79b
-
SHA1
7acff63bb6015fd72661c54ea307dfc47dd3062b
-
SHA256
c7b85134c686df5dc6d4c94722c01a201e9a307d210c96aa5a06601a4e70db0e
-
SHA512
1979bc092964a3f22accbea94d6c4a4fbf05b63e93248a46b6193b9a2adc0ee136d6e9a0c521aaea39b3bce9ffa2c084e68073795901f1350c820352efcff2c3
-
SSDEEP
12288:a1lrBZZzzoP32ZYP9OedtVnk9s/ZchRq:aBZxzoP32ZYPfnkMZs
Score
10/10
Malware Config
Extracted
Family
remcos
Botnet
RemoteHost
C2
172.96.14.18:2404
Attributes
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-OB0RTV
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
2984-15-0x0000000072FF0000-0x0000000074052000-memory.dmp
Headers
Sections