Rbmmuoavjkz8.exe

General
Target

Rbmmuoavjkz8.exe

Size

1MB

Sample

201112-4zdwhgymtx

Score
10 /10
MD5

92a24000ceaaf6dfffe49237ce46c711

SHA1

8ddd627b8f77d01d3f20541e66c43f6196573e12

SHA256

c9a855a5da51e96ec9c3c59f6331939b49bbdee2d9309f61ce92e326abdb3895

SHA512

6ecb7e65b795f7bc4984d2b6b5a4b622d7d3979d24ce414e6373e58ad834b1161870489ab5efe5c8edfa7ce1b8ff31e06ee8e3ba067a24c7d68dd80cf8504128

Malware Config

Extracted

Family remcos
C2

latua.nsupdate.info:7722

fanta.nsupdate.info:7722

coke.nsupdate.info:7722

Targets
Target

Rbmmuoavjkz8.exe

MD5

92a24000ceaaf6dfffe49237ce46c711

Filesize

1MB

Score
10 /10
SHA1

8ddd627b8f77d01d3f20541e66c43f6196573e12

SHA256

c9a855a5da51e96ec9c3c59f6331939b49bbdee2d9309f61ce92e326abdb3895

SHA512

6ecb7e65b795f7bc4984d2b6b5a4b622d7d3979d24ce414e6373e58ad834b1161870489ab5efe5c8edfa7ce1b8ff31e06ee8e3ba067a24c7d68dd80cf8504128

Tags

Signatures

  • Remcos

    Description

    Remcos is a closed-source remote control and surveillance software.

    Tags

  • Suspicious use of SetThreadContext

Related Tasks

MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Tasks

                          static1

                          behavioral1

                          10/10

                          behavioral2

                          10/10