General
-
Target
2440-44-0x0000000000400000-0x000000000047F000-memory.dmp
-
Size
508KB
-
MD5
23da433264683e8f8f60fc7158fc4952
-
SHA1
e8b644a8b94ad161df30fc359281aed71a23a2a6
-
SHA256
fd3f3eb3841fbfbfab7e492853a993e7c27ecc9d75e0331a81a1d608f15f5ce8
-
SHA512
29c13bb7976e0e7453c3e57d8f7637b8a39f3aafb61f87f11061b7617b142e1e6558db4723028a8f058b360e9a10303f722d065b93ae619e2967cfa4b06e2cf3
-
SSDEEP
12288:Omnk7iLJbpIpiRL6I2WhSKQ9ZsfZQSXn9:2iLJbpI7I2WhQqZ7X9
Score
10/10
Malware Config
Extracted
Family
remcos
Botnet
7272626
C2
windowsserverfebarch.duckdns.org:5841
Attributes
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
72626-GNX3E4
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
2440-44-0x0000000000400000-0x000000000047F000-memory.dmp
Headers
Sections