General
-
Target
2236-91-0x0000000015EA0000-0x0000000016EA0000-memory.dmp
-
Size
16.0MB
-
Sample
240422-zmqv8sgc2v
-
MD5
fb2df63ba5122aaba128e4edce8a9127
-
SHA1
ad7900ad6c76817775bd16cddab4156895497728
-
SHA256
198e713e3ef636dae3f1799db854249d2a9496b0776c05fcd3ccd109c543de45
-
SHA512
cf8ebc9022448654a78b0833a6b207466c8fb21a34404164c330a4511590f32744c34dae60fc42cea87d126f79c5fb279e3e2ca4807f0f9e4760b682d8ac09ca
-
SSDEEP
12288:xop09pJVEkL0EyqQzIrXhcu1s/ZUqccv:+EfVEkL0QXhlEZ
Behavioral task
behavioral1
Sample
2236-91-0x0000000015EA0000-0x0000000016EA0000-memory.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2236-91-0x0000000015EA0000-0x0000000016EA0000-memory.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
remcos
RemoteHost
127.0.0.1:44999
127.0.0.1:54991
africarem.duckdns.org:54991
africarem.duckdns.org:44999
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-R571U4
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
-
Target
2236-91-0x0000000015EA0000-0x0000000016EA0000-memory.dmp
-
Size
16.0MB
-
MD5
fb2df63ba5122aaba128e4edce8a9127
-
SHA1
ad7900ad6c76817775bd16cddab4156895497728
-
SHA256
198e713e3ef636dae3f1799db854249d2a9496b0776c05fcd3ccd109c543de45
-
SHA512
cf8ebc9022448654a78b0833a6b207466c8fb21a34404164c330a4511590f32744c34dae60fc42cea87d126f79c5fb279e3e2ca4807f0f9e4760b682d8ac09ca
-
SSDEEP
12288:xop09pJVEkL0EyqQzIrXhcu1s/ZUqccv:+EfVEkL0QXhlEZ
Score1/10 -