General
-
Target
3252-57-0x000000001BE40000-0x000000001BEC2000-memory.dmp
-
Size
520KB
-
Sample
240418-x9wc5ach52
-
MD5
f5d6854934f298db4de977c0961d3359
-
SHA1
91d29fa05f236d14244bfebf8744478be478aff1
-
SHA256
d82c35efe517d101ef05bdc924756cb86e3cea7879cd870da6d8147c9acc1729
-
SHA512
54a610eb4b1f52181d2f6130f2f4bd5f37249b5a801643b0716fa58e7bae67c4c11ac4083f08223672b5acd4d0c4f04dc58593f1c1a512ad19acf24a1f86e2b6
-
SSDEEP
6144:hzn68wr0Zl/BFc6PUxyYY0ES3x2wvE+JyjM64s1tbd2/sAOZZ/sXyKc5b5Gv:hO8FZVfZ8Qr0EK2wvErjZa/s/Z//cv
Behavioral task
behavioral1
Sample
3252-57-0x000000001BE40000-0x000000001BEC2000-memory.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
3252-57-0x000000001BE40000-0x000000001BEC2000-memory.exe
Resource
win10v2004-20240412-en
Malware Config
Extracted
remcos
RemoteHost
jantis.duckdns.org:1188
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
ffrrdds
-
mouse_option
false
-
mutex
Rmc-TALGAI
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
-
Target
3252-57-0x000000001BE40000-0x000000001BEC2000-memory.dmp
-
Size
520KB
-
MD5
f5d6854934f298db4de977c0961d3359
-
SHA1
91d29fa05f236d14244bfebf8744478be478aff1
-
SHA256
d82c35efe517d101ef05bdc924756cb86e3cea7879cd870da6d8147c9acc1729
-
SHA512
54a610eb4b1f52181d2f6130f2f4bd5f37249b5a801643b0716fa58e7bae67c4c11ac4083f08223672b5acd4d0c4f04dc58593f1c1a512ad19acf24a1f86e2b6
-
SSDEEP
6144:hzn68wr0Zl/BFc6PUxyYY0ES3x2wvE+JyjM64s1tbd2/sAOZZ/sXyKc5b5Gv:hO8FZVfZ8Qr0EK2wvErjZa/s/Z//cv
Score1/10 -