General
-
Target
2072-18-0x0000000000400000-0x0000000000482000-memory.dmp
-
Size
520KB
-
MD5
fc4de5fa6d4d0ae725028b8b4b8500c4
-
SHA1
8fbdfc206fabb8900c6b51f72397bc49904dda21
-
SHA256
cd0c63a07650132f8b60ff7d713998f669a42cb4d7c95eac9325a3e5a4390c8d
-
SHA512
e6e920b8fa101f89c32c4918018ee2bc977ed6ff11cba350a7cb7783727248d111a6c3d92baaafbcd51e6c6e571db7c993b0b84b1b4d2f767cd8a02647a2c600
-
SSDEEP
6144:I/7iPrcL3ArwhBq7Kjsn9iHGXg0lwGS9MNNhdFvPxps9gsAOZZuAXec7:I/uPq3AfK496Gw0lwGXN3pvs/Zu
Score
10/10
Malware Config
Extracted
Family
remcos
Botnet
XXXXXX
C2
busbuctomorrrw.ddns.net:6609
Attributes
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-JEV5XP
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
2072-18-0x0000000000400000-0x0000000000482000-memory.dmp
Headers
Sections