General
-
Target
1980-3-0x0000000000400000-0x000000000074D000-memory.dmp
-
Size
3.3MB
-
MD5
3ecd7d874ab59365ee5843e20443beb2
-
SHA1
878172342c809748a5c28dbd06e6e13cda449aeb
-
SHA256
692995776d235a4d9115fecaffbb15fea7b5e28b749cfbc1a20478468c3aedd5
-
SHA512
e462e5f1642954eb3cee64a3593b776a72421b804140741f5c52bd967ce35e6962f048fa9d4e1155057db3161694f0b0da4ff22101d57bfc8730995bc964fa3e
-
SSDEEP
6144:Y/7iPrcL3ArwhBq7Kjsn9iHGXg0lwGS9MNNhdFvPxps9osAOZZuAXecJw7ov0oP:Y/uPq3AfK496Gw0lwGXN3prs/Zu38v0
Score
10/10
Malware Config
Extracted
Family
remcos
Botnet
remote
C2
172.81.60.60:3467
Attributes
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
rem.exe
-
copy_folder
Rem
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
true
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-MRNXO2
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
1980-3-0x0000000000400000-0x000000000074D000-memory.dmp
Headers
Sections