Overview

overview

10

Static

static

09009000090.exe

windows7_x64

10

09009000090.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    09009000090.exe

  • Size

    243KB

  • Sample

    210114-jsknbmz7tn

  • MD5

    f6ecf089089d159be0094b2df9450419

  • SHA1

    aa2a6edb2f26bec4465e9f94ecc6849fb9a2b088

  • SHA256

    1619a67b0219aac78f1e5e8ac86ec2cf68641ba65a19653fc176916275b6f6ad

  • SHA512

    ac051fc7220b811a4d28156a34569beadf251de7ccb41e3e4c8a823b1c307cb15a5d55dcd28ce69eeeb0ad5d85d692f4f84f4bcf0984c71e88e545eb79c2082b

Score
10/10
remcosrat

Malware Config

Extracted

Family

remcos

C2

72.11.157.241:4445

Targets

    • Target

      09009000090.exe

    • Size

      243KB

    • MD5

      f6ecf089089d159be0094b2df9450419

    • SHA1

      aa2a6edb2f26bec4465e9f94ecc6849fb9a2b088

    • SHA256

      1619a67b0219aac78f1e5e8ac86ec2cf68641ba65a19653fc176916275b6f6ad

    • SHA512

      ac051fc7220b811a4d28156a34569beadf251de7ccb41e3e4c8a823b1c307cb15a5d55dcd28ce69eeeb0ad5d85d692f4f84f4bcf0984c71e88e545eb79c2082b

    Score
    10/10
    remcosrat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Drops startup file

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks