General
-
Target
944-211-0x0000000000560000-0x0000000000A51000-memory.dmp
-
Size
4.9MB
-
MD5
c85378f75e9314b88286b11851999534
-
SHA1
eab58974579916d4e473539c7e9251d07eaf6230
-
SHA256
58aba94f36f662f66999ae7a706e43efdda637c6e7d86a4b5c0bd0d5f316b34b
-
SHA512
40a0cf255f9c460f224ede8c5c919f6639844db40bccdddfb7eeead16159350fa01983a8862d66858a0ab1ec7b4974f84fe8891ce4ccc0f79c8961c1079b1d62
-
SSDEEP
12288:OFevT5m1fM1Ml5SIETj60HuMrs/ZozRq:ZvTw1fM1Ml5kHuMuZK
Score
10/10
Malware Config
Extracted
Family
remcos
Botnet
dream
C2
report1.duckdns.org:3380
Attributes
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-3IC60X
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
944-211-0x0000000000560000-0x0000000000A51000-memory.dmp
Headers
Sections