General
-
Target
2248-679-0x00000000004A0000-0x0000000001502000-memory.dmp
-
Size
16.4MB
-
Sample
240808-232zjssbjk
-
MD5
4817851b74f009f70a54d1ecf0b17864
-
SHA1
5b1169d063a74865e073c7d489982a2515f84970
-
SHA256
d4cbd87627e00ef5b3707e1f1eb26fe5a3e2599a2a3fcb277b1a290fb9b6e779
-
SHA512
a30cac29f46b5c3c5be31a163f6db0efc7270da7ec4d3b470985cbcba6267f3406b905618f1f9bcd8e092eab40347cdc69afe2d098183e99daf44a79ed4d0464
-
SSDEEP
12288:KZVxisGa7Uv1db9oXj8Nsh7s/ZdYLoT4:Kv7Uv1d7Nsh+ZmL
Behavioral task
behavioral1
Sample
2248-679-0x00000000004A0000-0x0000000001502000-memory.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2248-679-0x00000000004A0000-0x0000000001502000-memory.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
remcos
RemoteHost
45.66.231.198:2404
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-UPNP8J
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
-
Target
2248-679-0x00000000004A0000-0x0000000001502000-memory.dmp
-
Size
16.4MB
-
MD5
4817851b74f009f70a54d1ecf0b17864
-
SHA1
5b1169d063a74865e073c7d489982a2515f84970
-
SHA256
d4cbd87627e00ef5b3707e1f1eb26fe5a3e2599a2a3fcb277b1a290fb9b6e779
-
SHA512
a30cac29f46b5c3c5be31a163f6db0efc7270da7ec4d3b470985cbcba6267f3406b905618f1f9bcd8e092eab40347cdc69afe2d098183e99daf44a79ed4d0464
-
SSDEEP
12288:KZVxisGa7Uv1db9oXj8Nsh7s/ZdYLoT4:Kv7Uv1d7Nsh+ZmL
Score1/10 -