Overview

overview

10

Static

static

1

FA0900009000.exe

windows7_x64

10

FA0900009000.exe

windows10_x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    _FA0900009000.zip

  • Size

    133KB

  • Sample

    210422-4d5yf5kxke

  • MD5

    6cb530a7c6171a20aaec0d66e7480c0a

  • SHA1

    7889c8f69f2382e88e14ed3487a2eb91b41169ec

  • SHA256

    b49f6533c67e19cfc446f4c8cbfabac3e8009fe8e31f9ca6ba4a38c3869b3823

  • SHA512

    9f3a56a18f30ff67233dfb57190fdcd44f33162d2c9b075bb5444674b04685b05859b740b8c131083c79f966bfd62d940b918291bde540b5002b74464e174c9b

Score
10/10
remcosrat

Malware Config

Targets

    • Target

      FA0900009000.exe

    • Size

      415KB

    • MD5

      f5bbc275c2fe8892a7173cec02b48344

    • SHA1

      fb2bb2d7b845e442418f451dca20a1ca4fc45c5b

    • SHA256

      3bc2abc2f4f8e56df7dcc64602b053f62ade2953d76b6020a21c252cc86a41db

    • SHA512

      ce518ef7add1718ee63d0b7229f9a34a40a8060a21800de5191e5a0ecbbb1b88e6c35fcd795f42c54f9467b546873301470060c5a117bff10dd8fff7e664ff87

    Score
    10/10
    remcosrat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks