General
-
Target
4164-571-0x0000000000460000-0x00000000016B4000-memory.dmp
-
Size
18.3MB
-
Sample
241112-r3r48svdpm
-
MD5
dbb591137a513872d089a453a7df4c91
-
SHA1
dc5de7001a6f6b33058e92dd1d749e1748a4aceb
-
SHA256
d216198b8783400926b6e411a9efc8845366cf961df692ad15f34a3a6500cdd0
-
SHA512
cc06d0159806ad6e6ded91c464c8b4a5e2ba1a952e211f04820f439e3addb232018c20ef08c61269f4465873e72f421cdfa56f3703eba1b3d99622bae0196a85
-
SSDEEP
12288:7uD09AUkNIGBYYv4eK13x13nZHSRVMf139F5wIB7+IwtHwBtVkbesvZDSx+DY:+09AfNIEYsunZvZa9Z6s
Behavioral task
behavioral1
Sample
4164-571-0x0000000000460000-0x00000000016B4000-memory.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
4164-571-0x0000000000460000-0x00000000016B4000-memory.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
remcos
LoneWolf
odumegwu.duckdns.org:51525
odumeje1.duckdns.org:51525
odumeje.duckdns.org:51525
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-3DX9QW
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
-
Target
4164-571-0x0000000000460000-0x00000000016B4000-memory.dmp
-
Size
18.3MB
-
MD5
dbb591137a513872d089a453a7df4c91
-
SHA1
dc5de7001a6f6b33058e92dd1d749e1748a4aceb
-
SHA256
d216198b8783400926b6e411a9efc8845366cf961df692ad15f34a3a6500cdd0
-
SHA512
cc06d0159806ad6e6ded91c464c8b4a5e2ba1a952e211f04820f439e3addb232018c20ef08c61269f4465873e72f421cdfa56f3703eba1b3d99622bae0196a85
-
SSDEEP
12288:7uD09AUkNIGBYYv4eK13x13nZHSRVMf139F5wIB7+IwtHwBtVkbesvZDSx+DY:+09AfNIEYsunZvZa9Z6s
Score1/10 -