General
-
Target
2416-25-0x0000000000400000-0x0000000000482000-memory.dmp
-
Size
520KB
-
MD5
3d73979671a149712e209573c9b5f1fd
-
SHA1
8a83b8298796ad986a6e997c3903643e73bcc70d
-
SHA256
a24537c6b58ef833c28025e64b3259272041aeb3c69d9ac4ffb06ed99c57c75a
-
SHA512
34dcc9326d9cc3d32dc9148e1625bf3603c9efc26829be4f9b2eb9ec966947c0ec1e7973998b668615e53913a924bc7f03889de969afc80794a07a7711d6dbae
-
SSDEEP
6144:aXIktXfM8Lv86r9uVWAa2je4Z5zl4hgDHQQs4NTQjoHFsAOZZDAXYcN:aX7tPMK8ctGe4Dzl4h2QnuPs/ZD
Score
10/10
Malware Config
Extracted
Family
remcos
Botnet
Protected
C2
janbours92harbu01.duckdns.org:3980
janbours92harbu01.duckdns.org:3981
janbours92harbu02.duckdns.org:3980
Attributes
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
true
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
kajsoiestc.dat
-
keylog_flag
false
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
aksoiestgb-1YOAXH
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
- startup_value
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
2416-25-0x0000000000400000-0x0000000000482000-memory.dmp
Headers
Sections