General
-
Target
2892-22-0x0000000000400000-0x0000000000482000-memory.dmp
-
Size
520KB
-
MD5
85be8f6c5a6f40c32d22967ae3afa634
-
SHA1
a4ed03ee8f15cee1640a12488ff881e6a43bc39b
-
SHA256
6367c094a2dfb8d19609e47d43c60b68513b763e6c964ef3b6740c554adc683f
-
SHA512
ebeb75905113c16fbca73a8891606d157650d8894eb1d1fc92c36f764b6790a64cb20fa423396e2fe73b53d3adc4060db4c2b7a87479056db41ae725ed26e066
-
SSDEEP
6144:I/7iPrcL3ArwhBq7Kjsn9iHGXg0lwGS9MNNhdFvPxps9gsAOZZuAXec7:I/uPq3AfK496Gw0lwGXN3pvs/Zu
Score
10/10
Malware Config
Extracted
Family
remcos
Botnet
good
C2
194.147.140.212:1999
Attributes
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-PO4D1Z
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
2892-22-0x0000000000400000-0x0000000000482000-memory.dmp
Headers
Sections