Overview

overview

10

Static

static

Purchase Order..exe

windows7_x64

10

Purchase Order..exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Purchase Order..exe
  • Size 240KB
  • Sample201028-6c6ejhr3ee
  • SHA256 a1e66473cfdd393d62a203c1f16190106881f1fe6a671081e232f6ec1ab191fa
  • MD5 SHA1 SHA512
Score
10/10
remcosrat

Malware Config

Extracted

Family

  • remcos

C2

  • 79.134.225.50:42025

Targets

    • Target
      Purchase Order..exe
    • Size 240KB
    • SHA256 a1e66473cfdd393d62a203c1f16190106881f1fe6a671081e232f6ec1ab191fa
    • MD5 SHA1 SHA512
    Score
    10/10
    remcosrat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks