General
-
Target
1588-31-0x0000000000F00000-0x0000000001F62000-memory.dmp
-
Size
16.4MB
-
MD5
9cc000d2f98f678d636bbe2d4b934aeb
-
SHA1
e0d449ad0420f5ddc0c6a74e25b388a9f552ecf4
-
SHA256
cbfebcf0457e1d22587e70bb38bcf1e39f711d5dddbd3972ebf2ac138d4fbfb2
-
SHA512
7fda43e3bb824313f584b4038f41fa67f002d4e069f4787fa3b6fc1cbed0bfa0ca0b26e01e61c54a835ba514f1ad4b42af42b52b60cbd530b6833c981da1632c
-
SSDEEP
6144:sokdHv7gHY2RWNOV2QpUvez+4ud2ZD1IRgD3AQM4xADYH2sAOZZMgXIct05Gv:s7dPc6scMU2+4u4D1IRmAnDs/ZMFcv
Score
10/10
Malware Config
Extracted
Family
remcos
Botnet
RemoteHost
C2
103.67.163.213:9462
Attributes
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-PAORFL
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
1588-31-0x0000000000F00000-0x0000000001F62000-memory.dmp
Headers
Sections