General
-
Target
1076-67-0x000000006FC90000-0x0000000070CF2000-memory.dmp
-
Size
16.4MB
-
MD5
7ae9f9b74f7d416cbd041c6aa9f16407
-
SHA1
f2fc83bbf3fbd9be1efe4757b0498147cc2aa0f3
-
SHA256
d450f2f81cce2fa4406ed67028eaace415c3555aa5e866f951d8b3f6d7389e83
-
SHA512
ab1330f45e19cc4c518adacd87f25497e579b3330358fe4ec83efc144cac3b2b9e168758035600865b5a9fd6dbdc9ed469d2d818c8dac26c9cfb49a7673a55f1
-
SSDEEP
12288:oC9uQ6P1IdjSoRSGiq3eA1/cOl1as/ZyH8v:GQ6PaSoRSG//cOlrZ
Score
10/10
Malware Config
Extracted
Family
remcos
Botnet
RemoteHost
C2
94.156.6.57:6657
Attributes
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-D3X3WS
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
1076-67-0x000000006FC90000-0x0000000070CF2000-memory.dmp
Headers
Sections