Overview

overview

10

Static

static

PO AR483-1...JT.exe

windows7_x64

10

PO AR483-1...JT.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    PO AR483-1590436 FOR J-3000433707 PROJT.exe
  • Size 1.1MB
  • Sample210302-389thdh832
  • SHA256 b782581b1ca3da09fdf3ecbb173ee3ca1f313f5f325f407df976601cad8ce839
  • MD5 SHA1 SHA512
Score
10/10
remcospersistencerat

Malware Config

Extracted

Family

  • remcos

C2

  • tulicknewfavour.ddns.net:4033

Targets

    • Target
      PO AR483-1590436 FOR J-3000433707 PROJT.exe
    • Size 1.1MB
    • SHA256 b782581b1ca3da09fdf3ecbb173ee3ca1f313f5f325f407df976601cad8ce839
    • MD5 SHA1 SHA512
    Score
    10/10
    remcospersistencerat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks