General
-
Target
1804-54-0x0000000000400000-0x0000000000482000-memory.dmp
-
Size
520KB
-
MD5
f7b24b2ea4480026fb1f42669fd2b8c6
-
SHA1
be6ecd815d16d4717a5e9d4a9d83dd2b65b2d12f
-
SHA256
94f973a57251611bed19077531e48a3a47a0e326be8be2da46ab56a82ec24586
-
SHA512
1678df37012b21ccb29932a81ae985aa9186b367e4e553d0632f8f1f5c7d820463836b3e838a94cdb6b0945b641b9f86992c70aab377c2a5cb78bff3064a3b0b
-
SSDEEP
6144:CXIktXfM8Lv86r9uVWAa2je4Z5zl4hgDHQQs4NTQjoHusAOZZsAX4cp95Gv:CX7tPMK8ctGe4Dzl4h2Qnu0s/Zsccv
Score
10/10
Malware Config
Extracted
Family
remcos
Botnet
RemoteHost
C2
107.175.229.139:8087
Attributes
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
5
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
yes.png
-
keylog_flag
false
-
keylog_folder
aka
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
jhudguiytgu-AAHEXC
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
1804-54-0x0000000000400000-0x0000000000482000-memory.dmp
Headers
Sections