General

  • Target

    784-112-0x0000000000400000-0x0000000000482000-memory.dmp

  • Size

    520KB

  • MD5

    716e026f78f185bdeb4f52f20864300e

  • SHA1

    e5a35fa5002dd5a193ce47e080796a43f0817af2

  • SHA256

    b589cbce775079a0c8478738d3045229b990dc1b82d2b9437b5be42bc4bcd964

  • SHA512

    6937d854db7d73b8c46cacf7a505004bb51cb0c0e61427b89faa1219a01756e2dcb1f868cca4a57ebcc54b78c1b6a9b37c1943bc52b33a3563d7308b826f33e9

  • SSDEEP

    6144:MXIktXfM8Lv86r9uVWAa2je4Z5zl4hgDHQQs4NTQjoHFsAOZZDAXYcN:MX7tPMK8ctGe4Dzl4h2QnuPs/ZD

Score
10/10

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

192.3.216.142:7232

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-PGR5EA

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 784-112-0x0000000000400000-0x0000000000482000-memory.dmp
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections