Overview

overview

10

Static

static

1

Quote.exe

windows7_x64

10

Quote.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Quote.exe
  • Size 233KB
  • Sample210217-tzlm4actmn
  • SHA256 79e70809a85e291f9da3d391131208ce7645dd512eb6bb71811154b43da23222
  • MD5 SHA1 SHA512
Score
10/10
remcospersistencerat

Malware Config

Extracted

Family

  • remcos

C2

  • 103.89.88.238:4299

Targets

    • Target
      Quote.exe
    • Size 233KB
    • SHA256 79e70809a85e291f9da3d391131208ce7645dd512eb6bb71811154b43da23222
    • MD5 SHA1 SHA512
    Score
    10/10
    remcospersistencerat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks