General
-
Target
1320-107-0x00000000295D0000-0x0000000029652000-memory.dmp
-
Size
520KB
-
MD5
df15ad8d33a3ee958e2d88fc4e39b7e0
-
SHA1
0e21edc129e534e5d79c06217d5ec6e96fedfebf
-
SHA256
2a67f4c8d3b33b32878724566b86b307c666a90bbb9176c0153a4d14ea05aaee
-
SHA512
1644ea8ad4e4311356dcaf753a22090d7f83f9a5858ccdde16c8d18b931de90ec319f275bf32bc55176ec61d99fc3c0f73abba90fa31b76874e800f0fbb4591e
-
SSDEEP
6144:8OEN2mfk0TBsx6Iou9e4d97p0pah2asZMo6DWvWNeS/sAOZZ24XZqc425Gv:8BN2MkuyczIe4T7p0p3as9Ms/Z2ccv
Score
10/10
Malware Config
Extracted
Family
remcos
Botnet
RemoteHost
C2
127.0.0.1:59089
legacyrem.duckdns.org:59089
Attributes
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-BF03RK
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
1320-107-0x00000000295D0000-0x0000000029652000-memory.dmp
Headers
Sections