General
-
Target
2220-107-0x0000000000E30000-0x0000000001E92000-memory.dmp
-
Size
16.4MB
-
Sample
240417-ra8aracc9y
-
MD5
91d12800e598ba6eb7d0572f0c8b199a
-
SHA1
51097ecb21d3c491954788d37e1c4c7b55378540
-
SHA256
02f5da490829c86cc81b21fe57b1381afe36b90662e30ab30921567b17e5bd35
-
SHA512
0f3480c645d6742e5b118a722c5ccb359503418ab8670aeaf5bb2ed6eaac837c92f96e7b49a504d4dad3dbecb5cdba4fe16c1b27cd85cd36db599d04f83a9424
-
SSDEEP
6144:TV+Q2FExNJ4r9uVWAa2je4Z5zl4hgDHQQs4NTQjoHtsAOZZDAXYcNk5Gv:TsQLxfS8ctGe4Dzl4h2QnuTs/ZDBcv
Behavioral task
behavioral1
Sample
2220-107-0x0000000000E30000-0x0000000001E92000-memory.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2220-107-0x0000000000E30000-0x0000000001E92000-memory.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
remcos
Protect
darvien99lakoustr01.duckdns.org:3770
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
true
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
lmouitrs.dat
-
keylog_flag
false
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
akmsnxbfg-E906PA
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
- startup_value
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
-
Target
2220-107-0x0000000000E30000-0x0000000001E92000-memory.dmp
-
Size
16.4MB
-
MD5
91d12800e598ba6eb7d0572f0c8b199a
-
SHA1
51097ecb21d3c491954788d37e1c4c7b55378540
-
SHA256
02f5da490829c86cc81b21fe57b1381afe36b90662e30ab30921567b17e5bd35
-
SHA512
0f3480c645d6742e5b118a722c5ccb359503418ab8670aeaf5bb2ed6eaac837c92f96e7b49a504d4dad3dbecb5cdba4fe16c1b27cd85cd36db599d04f83a9424
-
SSDEEP
6144:TV+Q2FExNJ4r9uVWAa2je4Z5zl4hgDHQQs4NTQjoHtsAOZZDAXYcNk5Gv:TsQLxfS8ctGe4Dzl4h2QnuTs/ZDBcv
Score1/10 -