General
-
Target
4964-67-0x00000000010B0000-0x0000000002304000-memory.dmp
-
Size
18.3MB
-
MD5
4436810df27b8e2e9bc4fbef247276c3
-
SHA1
f75f9f57f284b1f4232491251836eb2c988c103b
-
SHA256
92884cc0c2bb70c9838b5de25a65a47d4a66e95abb9b151f7d23f3c4f8ddb261
-
SHA512
f6f06168beb9b94293bf78a03035c88f48cf16e82453495aaa57ffc43e25ae71a79a877ebdd53cfdb5b007dffc142f6edc28932141277f64943f5bc2afb88eeb
-
SSDEEP
12288:Q8ZgTidz5XNcUxoTnUtzO/MD0McsvZRGzA4:bzdz5XNXtq/MYMHZw
Score
10/10
Malware Config
Extracted
Family
remcos
Botnet
520
C2
renajazinw.duckdns.org:53848
Attributes
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
Windeep.exe
-
copy_folder
AppDir
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-N1P6UN
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
4964-67-0x00000000010B0000-0x0000000002304000-memory.dmp
Headers
Sections