General
-
Target
2652-13-0x0000000000400000-0x0000000000482000-memory.dmp
-
Size
520KB
-
MD5
a3c2eb92f1e9e8df78d07ceb5f6c0e54
-
SHA1
28c5cc5e6e88f4a6c1a995254c446e87fedf5fc2
-
SHA256
66833445a3d78cb43dadaac6666e38f742067e6121e35d938425d977f01e1436
-
SHA512
cb580257373aa1b5388ae3ec3395f0d50df4d5f25659899b321c610e6cd563092242b73aaef93a3a3bb17a260cd4addab06278c539f1b9a67da6cc7496a4ac37
-
SSDEEP
6144:cXIktXfM8Lv86r9uVWAa2je4Z5zl4hgDHQQs4NTQjoHFsAOZZsAX4cN:cX7tPMK8ctGe4Dzl4h2QnuPs/Zs
Score
10/10
Malware Config
Extracted
Family
remcos
Botnet
host
C2
185.70.104.90:2404
185.70.104.90:8080
185.70.104.90:465
Attributes
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
host.exe
-
copy_folder
updates
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
true
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
updates
-
mouse_option
false
-
mutex
vgd-YS3L24
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
2652-13-0x0000000000400000-0x0000000000482000-memory.dmp
Headers
Sections