General
-
Target
4796-28-0x0000000072D50000-0x0000000073FA4000-memory.dmp
-
Size
4.6MB
-
MD5
b638158190e94c3edc21d0c07b98cbf1
-
SHA1
ca7b8c1ae04cde63f37050d77bfdd664e79cd7ad
-
SHA256
95877384f26a8325b48ab2c2865e79f5c02536602d084e759cee9b9dde56f7cc
-
SHA512
dbf0679fe40f6f9ec3406fc5bcf0b6125d5dfdaa0b6a0cdc0daba9177971dd2b738ac4d24669d0a9fe05a9410fb115bcc7b885b36e817b0db0bc46c091eba3b6
-
SSDEEP
6144:QIZRRNZXoIxw6hcmOgBSHGjt00Tc5g/3OtZY7duHbvMMzPLYA+YsAOZZpAXNc7ij:9HRNiIxwx+wmq045g/3Nu7XPs/Zpubv
Score
10/10
Malware Config
Extracted
Family
remcos
Botnet
Crypted
C2
ourt2949aslumes9.duckdns.org:2401
Attributes
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
true
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
paqlgkfs.dat
-
keylog_flag
false
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
ourvbpld-RBN2WW
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
- startup_value
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
4796-28-0x0000000072D50000-0x0000000073FA4000-memory.dmp
Headers
Sections