General
-
Target
2412-2-0x0000000000400000-0x000000000047F000-memory.dmp
-
Size
508KB
-
MD5
37fe7a7dbe878cc24dcabada968d536d
-
SHA1
d035ac3c0df62d3b32cb8d8293a2a14bca912aa3
-
SHA256
3d53ffffe578da07ab73195eeffdea378e266bcd1328b5237860d779e0277c41
-
SHA512
8bac7bbd222e28c5221be6aa2508926a21ee9191e1842898a0d36651dd56f6af4d08371988142cc9b27e0c28a60cf63d0e00142a916614f745cbd50b0415e6c7
-
SSDEEP
12288:nuD09AUkNIGBYYv4eK13x13nZHSRVMf139F5wIB7+IwtHwBtVwUbesvZDSn+DY:a09AfNIEYsunZvZB9ZYs
Score
10/10
Malware Config
Extracted
Family
remcos
Botnet
elvis
C2
107.173.4.16:2560
Attributes
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-GJDISH
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
2412-2-0x0000000000400000-0x000000000047F000-memory.dmp
Headers
Sections