General
-
Target
4088-70-0x0000000000400000-0x0000000000484000-memory.dmp
-
Size
528KB
-
MD5
be55938f8089d9d452f152f8c6ab445c
-
SHA1
3970381c15ae3306497b8f946a76067a8f4a2c2c
-
SHA256
9a55315e295664921442992eafda6c8de5b2c88b466b469ad18147137438c82b
-
SHA512
016419eda6644e77b17d23da02fc75dca7805b7cbc891ec45e13c73b8bfb2b0a80b5670f07d55642685837b1473f1b3f5d1b5ddb433f710fe8e20cd33f64d1a3
-
SSDEEP
6144:bTz+c6KHYBhDc1RGJdv//NkUn+N5Bkf/0TELRvIZ5jbsAOZZ7AXpcrlT4:bTlrYw1RUh3NFn+N5WfIQajbs/Z79T4
Score
10/10
Malware Config
Extracted
Family
remcos
Botnet
Back-September
C2
fullimmersion777.com:8090
Attributes
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
hello.exe
-
copy_folder
windw
-
delete_file
false
-
hide_file
true
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
rimcsl-94LESJ
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
4088-70-0x0000000000400000-0x0000000000484000-memory.dmp
Headers
Sections