Overview

overview

10

Static

static

DHL, pdf88...��.exe

windows7_x64

10

DHL, pdf88...��.exe

windows10_x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    DHL, pdf8897209547 பெற ஆவணங்கள்.exe
  • Size 388KB
  • Sample200721-gg6blg8f2a
  • SHA256 6307b6ffc48a88aeeff567c7a296ca6daf830f9b4eecf9f48352c489e5256fca
  • MD5 SHA1 SHA512
Score
10/10
remcospersistencerat

Malware Config

Extracted

Family

  • remcos

C2

  • zimchi2020.ddns.net:7171

Targets

    • Target
      DHL, pdf8897209547 பெற ஆவணங்கள்.exe
    • Size 388KB
    • SHA256 6307b6ffc48a88aeeff567c7a296ca6daf830f9b4eecf9f48352c489e5256fca
    • MD5 SHA1 SHA512
    Score
    10/10
    ratremcospersistence

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks