Overview

overview

10

Static

static

Shipping D...df.exe

windows7_x64

10

Shipping D...df.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Shipping Document PL&BL003534,pdf.exe
  • Size 675KB
  • Sample210106-2lqcmcdhjs
  • SHA256 aeb1aab3be5b90cb85bfe28f0e092c83fee4a742a9cda7b0d8a6e464e6fa7342
  • MD5 SHA1 SHA512
Score
10/10
remcospersistencerat

Malware Config

Extracted

Family

  • remcos

C2

  • blessings2021.ddns.net:2021

Targets

    • Target
      Shipping Document PL&BL003534,pdf.exe
    • Size 675KB
    • SHA256 aeb1aab3be5b90cb85bfe28f0e092c83fee4a742a9cda7b0d8a6e464e6fa7342
    • MD5 SHA1 SHA512
    Score
    10/10
    remcospersistencerat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks