General
-
Target
1320-107-0x00000000295D0000-0x0000000029652000-memory.dmp
-
Size
520KB
-
Sample
240814-j3mwhswfql
-
MD5
df15ad8d33a3ee958e2d88fc4e39b7e0
-
SHA1
0e21edc129e534e5d79c06217d5ec6e96fedfebf
-
SHA256
2a67f4c8d3b33b32878724566b86b307c666a90bbb9176c0153a4d14ea05aaee
-
SHA512
1644ea8ad4e4311356dcaf753a22090d7f83f9a5858ccdde16c8d18b931de90ec319f275bf32bc55176ec61d99fc3c0f73abba90fa31b76874e800f0fbb4591e
-
SSDEEP
6144:8OEN2mfk0TBsx6Iou9e4d97p0pah2asZMo6DWvWNeS/sAOZZ24XZqc425Gv:8BN2MkuyczIe4T7p0p3as9Ms/Z2ccv
Behavioral task
behavioral1
Sample
1320-107-0x00000000295D0000-0x0000000029652000-memory.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
1320-107-0x00000000295D0000-0x0000000029652000-memory.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
remcos
RemoteHost
127.0.0.1:59089
legacyrem.duckdns.org:59089
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-BF03RK
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
-
Target
1320-107-0x00000000295D0000-0x0000000029652000-memory.dmp
-
Size
520KB
-
MD5
df15ad8d33a3ee958e2d88fc4e39b7e0
-
SHA1
0e21edc129e534e5d79c06217d5ec6e96fedfebf
-
SHA256
2a67f4c8d3b33b32878724566b86b307c666a90bbb9176c0153a4d14ea05aaee
-
SHA512
1644ea8ad4e4311356dcaf753a22090d7f83f9a5858ccdde16c8d18b931de90ec319f275bf32bc55176ec61d99fc3c0f73abba90fa31b76874e800f0fbb4591e
-
SSDEEP
6144:8OEN2mfk0TBsx6Iou9e4d97p0pah2asZMo6DWvWNeS/sAOZZ24XZqc425Gv:8BN2MkuyczIe4T7p0p3as9Ms/Z2ccv
Score1/10 -