General
-
Target
1156-201-0x00000000002D0000-0x00000000008A6000-memory.dmp
-
Size
5.8MB
-
MD5
3d3456f5195f08339ef8375a9863aab9
-
SHA1
ae7473111452efb497c80641a187941f8b38d180
-
SHA256
5bf9d9b351328e5fb4770a3034c3f2c3d76db1d4c18395ac04e0297938001dda
-
SHA512
dc441e60d9cc506267d4683b2989f332e1be3e5ea12ed9d09e815778744d8e21f36b12f7c7b9cdb59f27262e8a73f28f25bb8c7f4f8595b8f2753e1d9c0232e9
-
SSDEEP
12288:mfW3NcbYXxG5YavaXJeiiKeOnrsvZLvE+DY:mW3NcMXxQY6OeOneZgs
Score
10/10
Malware Config
Extracted
Family
remcos
Botnet
STOP
C2
novermber12.duckdns.org:65320
Novermber12.freeddns.org:65320
Novermber12.freeddns.org/novermber12.duckdns.org:65320
Attributes
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-2SJINH
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
1156-201-0x00000000002D0000-0x00000000008A6000-memory.dmp
Headers
Sections