General
-
Target
4796-28-0x0000000072D50000-0x0000000073FA4000-memory.dmp
-
Size
4.6MB
-
Sample
231111-qdsh2age85
-
MD5
b638158190e94c3edc21d0c07b98cbf1
-
SHA1
ca7b8c1ae04cde63f37050d77bfdd664e79cd7ad
-
SHA256
95877384f26a8325b48ab2c2865e79f5c02536602d084e759cee9b9dde56f7cc
-
SHA512
dbf0679fe40f6f9ec3406fc5bcf0b6125d5dfdaa0b6a0cdc0daba9177971dd2b738ac4d24669d0a9fe05a9410fb115bcc7b885b36e817b0db0bc46c091eba3b6
-
SSDEEP
6144:QIZRRNZXoIxw6hcmOgBSHGjt00Tc5g/3OtZY7duHbvMMzPLYA+YsAOZZpAXNc7ij:9HRNiIxwx+wmq045g/3Nu7XPs/Zpubv
Behavioral task
behavioral1
Sample
4796-28-0x0000000072D50000-0x0000000073FA4000-memory.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
4796-28-0x0000000072D50000-0x0000000073FA4000-memory.exe
Resource
win10v2004-20231023-en
Malware Config
Extracted
remcos
Crypted
ourt2949aslumes9.duckdns.org:2401
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
true
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
paqlgkfs.dat
-
keylog_flag
false
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
ourvbpld-RBN2WW
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
- startup_value
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
-
Target
4796-28-0x0000000072D50000-0x0000000073FA4000-memory.dmp
-
Size
4.6MB
-
MD5
b638158190e94c3edc21d0c07b98cbf1
-
SHA1
ca7b8c1ae04cde63f37050d77bfdd664e79cd7ad
-
SHA256
95877384f26a8325b48ab2c2865e79f5c02536602d084e759cee9b9dde56f7cc
-
SHA512
dbf0679fe40f6f9ec3406fc5bcf0b6125d5dfdaa0b6a0cdc0daba9177971dd2b738ac4d24669d0a9fe05a9410fb115bcc7b885b36e817b0db0bc46c091eba3b6
-
SSDEEP
6144:QIZRRNZXoIxw6hcmOgBSHGjt00Tc5g/3OtZY7duHbvMMzPLYA+YsAOZZpAXNc7ij:9HRNiIxwx+wmq045g/3Nu7XPs/Zpubv
Score1/10 -