General
-
Target
3016-6-0x00000000000C0000-0x0000000000142000-memory.dmp
-
Size
520KB
-
MD5
1cdffc4ca691643a0cbbe84819cb179e
-
SHA1
3bada9cb4e385e1d672bd080dcb2098be92c0922
-
SHA256
be158772adc1d253317728b371c7dea0a5033266592571e4b4395c2208f4fb35
-
SHA512
9192be63d7141a15dc09e36eb1916c1baf9c301c40421f9e02de5bedec3193b55c265136c0d603b4d39bb288a5e1fb546b981994f072555239956562c9f1f43b
-
SSDEEP
6144:4kUpb74cR552V28q2v+wFBfZ0147bEYM4tz8bE/dsAOZZgoXgcto5Gv:4vp/4e5gspS+wffZ01aEP83s/Zg9cv
Score
10/10
Malware Config
Extracted
Family
remcos
Botnet
KILOS
C2
card25.con-ip.com:1664
Attributes
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-E50BIC
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
3016-6-0x00000000000C0000-0x0000000000142000-memory.dmp
Headers
Sections