General
-
Target
4168-15-0x0000000000420000-0x00000000004A2000-memory.dmp
-
Size
520KB
-
MD5
7acd26b54417a59ad8fca6447c36cc5d
-
SHA1
310462fd09d34fcdad76423082d3bc66d9bec90b
-
SHA256
4fa080c3a1474a6923b48263b3d877f0fa15355b761c74bc23a1d83e34224b7b
-
SHA512
2317e6216d2aa78b621ae712566b238d542c016999e968a5d0f478fc614a3f434947e46c6e78f2efa3ed2174e20b98d54b6694c3c195dcc597252814ab33d5e2
-
SSDEEP
12288:7cpzvyJeSYzwOARTdLmXmLeDqs/ZbxKcv:+2eSYzwOmXeDxZ9
Score
10/10
Malware Config
Extracted
Family
remcos
Botnet
MAY DEVOTION 2024
C2
pentester0.accesscam.org:56796
archived.zapto.org:56797
honeypotresearchteam.duckdns.org:13922
Attributes
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
wetransfer.exe
-
copy_folder
wetransfer
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
wetransfer
-
mouse_option
false
-
mutex
wetransfer-F4RIT7
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
4168-15-0x0000000000420000-0x00000000004A2000-memory.dmp
Headers
Sections