Overview

overview

10

Static

static

DOCUMENTAC...28.exe

windows7_x64

10

DOCUMENTAC...28.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    DOCUMENTACIONJUXGADOPROCESAL68584983243128.exe

  • Size

    378KB

  • Sample

    201230-hw9a8w68ta

  • MD5

    291b17288e1b5919f9bf5173a3519cb3

  • SHA1

    b88282c8e5a7546dd6363653bc68d1353163d3f6

  • SHA256

    dcbd91d1d7361dc9b34c907f1d1d2677837ce29f6f3ab3f4994bb82ccce88dc5

  • SHA512

    5fb634203786a7401ce15f55d433b19546a640747f9482f8a906464fca58b5e5d7696a618f721f32e0d73c02a256a74335803344b646891b0943303e122eba0a

Score
10/10
remcosrat

Malware Config

Extracted

Family

remcos

C2

jueces23.duckdns.org:1212

Targets

    • Target

      DOCUMENTACIONJUXGADOPROCESAL68584983243128.exe

    • Size

      378KB

    • MD5

      291b17288e1b5919f9bf5173a3519cb3

    • SHA1

      b88282c8e5a7546dd6363653bc68d1353163d3f6

    • SHA256

      dcbd91d1d7361dc9b34c907f1d1d2677837ce29f6f3ab3f4994bb82ccce88dc5

    • SHA512

      5fb634203786a7401ce15f55d433b19546a640747f9482f8a906464fca58b5e5d7696a618f721f32e0d73c02a256a74335803344b646891b0943303e122eba0a

    Score
    10/10
    remcosrat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks