General

  • Target

    2008-21-0x00000000004A0000-0x00000000016F4000-memory.dmp

  • Size

    18.3MB

  • MD5

    46c3eb4633b9b708064b62a8593e0a22

  • SHA1

    d7ea41d6410523bb38863fa0564951ad3e5ce1bd

  • SHA256

    a2cbfef22b769c75332fa85bf24c21c455e0bf7714599403f9c5f47b1b8a0cdd

  • SHA512

    d8fb64179380dc5bfbadba7d020de2dfe8d9e9dc488eeee2d01780337709ade29ef1c9f96be7c615963d14744f993ffc0e7d76cae52b1beac79266764c250b8b

  • SSDEEP

    12288:KhLfKtGqYboOQbpVT+/QWz5ODLs/Zkdcv:sHqYboOUWzVZ

Score
10/10

Malware Config

Extracted

Family

remcos

Botnet

Client

C2

46.183.223.29:2404

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    images.exe

  • copy_folder

    images

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    true

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-ZOAGZI

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2008-21-0x00000000004A0000-0x00000000016F4000-memory.dmp
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections