General

  • Target

    ADJUENWORDSOBREPROCEV4363450005 ADJUENWORDSOBREPROCEV4363450007.exe

  • Size

    955KB

  • Sample

    210422-1e6ghqmfl6

  • MD5

    66bc12a8ad1e13c3e6dd65bd6db4790a

  • SHA1

    61048635297de9edf916ab5c2bbeeac865cad997

  • SHA256

    419000b66f04ce0f9b5b3b9f4825d4b68d21df27e99d02b483bd96aa240413d7

  • SHA512

    0f9fe805f7926a686382da2acc24da889be640b1951eb1a68c4f853aca56e7f3b1ff13d213d419f18e64b49f7a1c38edec556e2531d89c44e02755b286cec1aa

Score
10/10

Malware Config

Extracted

Family

remcos

C2

portugal16.duckdns.org:1717

Targets

    • Target

      ADJUENWORDSOBREPROCEV4363450005 ADJUENWORDSOBREPROCEV4363450007.exe

    • Size

      955KB

    • MD5

      66bc12a8ad1e13c3e6dd65bd6db4790a

    • SHA1

      61048635297de9edf916ab5c2bbeeac865cad997

    • SHA256

      419000b66f04ce0f9b5b3b9f4825d4b68d21df27e99d02b483bd96aa240413d7

    • SHA512

      0f9fe805f7926a686382da2acc24da889be640b1951eb1a68c4f853aca56e7f3b1ff13d213d419f18e64b49f7a1c38edec556e2531d89c44e02755b286cec1aa

    Score
    10/10
    • Remcos

      Remcos is a closed-source remote control and surveillance software.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks