General

  • Target

    1708-39-0x0000000000710000-0x0000000000793000-memory.dmp

  • Size

    524KB

  • MD5

    410880e2ff68ac276a594e9e54d38c38

  • SHA1

    c390b640a826b20f1559031e6f2e9306784e19e8

  • SHA256

    bcd37cb54075433b6b22998cae98e0fc0140b37717e4ae2ef4257d3e4a4e5c3c

  • SHA512

    bd817880bb2fb86a02db48fe1c85712871a47f013504f90a0b99aecc76769b37d131755cf5dde50e6463b9def966a778fb0e4f5ff2ef5c1cd7a3a6c87bdd12af

  • SSDEEP

    6144:ceLgLwghsqCOIODUlRRWkXwckkqSg/+p9K9iacrzbim3BbisAOZZdehXNche7ovg:csbgFCOqvUkTkR/+p9icnos/Zd08vg

Score
10/10

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

listpoints.online:6090

retghrtgwtrgtg.bounceme.net:3839

listpoints.click:7020

datastream.myvnc.com:5225

gservicese.com:2718

center.onthewifi.com:8118

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    explorer.exe

  • delete_file

    false

  • hide_file

    true

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-BXAQVH

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 1708-39-0x0000000000710000-0x0000000000793000-memory.dmp
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.