General

  • Target

    2764-42-0x0000000003B60000-0x0000000003BE2000-memory.dmp

  • Size

    520KB

  • MD5

    663a87416e0bb872e388d096604073b3

  • SHA1

    6b1ce2a5f4b0bc0110c8075aadc38b1fd75267e1

  • SHA256

    996421cd2f256be9534e40b3641ff3b5eb29332f9bf07068873a0e7687113b7c

  • SHA512

    d1499ee7fca014399347220c837c19a771530c1a144df7afbdecdf97e27f05d5f18971091bb7416b8fc394acc3ed2c47ba80a1015f2c6c8408df05921e35019e

  • SSDEEP

    6144:2/7iPrcL3ArwhBq7Kjsn9iHGXg0lwGS9MNNhdFvPxps9DxsAOZZuAXec7:2/uPq3AfK496Gw0lwGXN3pus/Zu

Score
10/10

Malware Config

Extracted

Family

remcos

Botnet

HONEYPORT TEAM

C2

honeyportsecurityresearchteam.duckdns.org:17694

pentester0.accesscam.org:56796

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    Sharepont.exe

  • copy_folder

    Sharepoints

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Xmas-258ECQ

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2764-42-0x0000000003B60000-0x0000000003BE2000-memory.dmp
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections