Overview

overview

10

Static

static

NEW_PURCHA...20.exe

windows7_x64

10

NEW_PURCHA...20.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    NEW_PURCHASING_ORDER-2020.exe
  • Size 10.0MB
  • Sample201105-e9mhmkz6fx
  • SHA256 8cffc3d5b5b830c82c8c9f958a699fb4668d39df6ae0b2f50ec68571c9eac6d9
  • MD5 SHA1 SHA512
Score
10/10
remcosrat

Malware Config

Extracted

Family

  • remcos

C2

  • www.ecxco.com:2404

Targets

    • Target
      NEW_PURCHASING_ORDER-2020.exe
    • Size 10.0MB
    • SHA256 8cffc3d5b5b830c82c8c9f958a699fb4668d39df6ae0b2f50ec68571c9eac6d9
    • MD5 SHA1 SHA512
    Score
    10/10
    remcosrat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Drops startup file

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks