DOC20210403A266NR5282RBL20266178278_PDF.exe

General
Target

DOC20210403A266NR5282RBL20266178278_PDF.exe

Size

845KB

Sample

210408-6rsf1m9alj

Score
10 /10
MD5

7ccc15217d4c2a598b5b04ec928f32a4

SHA1

c3828f550527c84fa7150ae944167d3ee9ca726b

SHA256

8dc3da77d945f8df3206906bcf76f1096e4db213a9b7b5911d7f0e8eaf3c8b67

SHA512

6911909546c988ea561d19e1bb8dd0afe47690cc81cb62dca97eadf7be5bb11d1c6bc6caa27368f2d0f9461c618f10728a36ca59b43f8bf8f12d03743a1876c1

Malware Config

Extracted

Family remcos
C2

olorunwa.duckdns.org:6548

Targets
Target

DOC20210403A266NR5282RBL20266178278_PDF.exe

MD5

7ccc15217d4c2a598b5b04ec928f32a4

Filesize

845KB

Score
10 /10
SHA1

c3828f550527c84fa7150ae944167d3ee9ca726b

SHA256

8dc3da77d945f8df3206906bcf76f1096e4db213a9b7b5911d7f0e8eaf3c8b67

SHA512

6911909546c988ea561d19e1bb8dd0afe47690cc81cb62dca97eadf7be5bb11d1c6bc6caa27368f2d0f9461c618f10728a36ca59b43f8bf8f12d03743a1876c1

Tags

Signatures

  • Remcos

    Description

    Remcos is a closed-source remote control and surveillance software.

    Tags

  • Adds Run key to start application

    Tags

    TTPs

    Registry Run Keys / Startup Folder Modify Registry
  • Suspicious use of SetThreadContext

Related Tasks

MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
        Discovery
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Privilege Escalation
                      Tasks

                      static1

                      behavioral1

                      10/10

                      behavioral2

                      10/10