General

  • Target

    Authorization letter formatducsigned contract.js

  • Size

    236KB

  • Sample

    210422-wv5q9fa8xs

  • MD5

    c9c780c8c5104c5b0dbabe46bcc3e0b7

  • SHA1

    e1ed4e375a527e0804a9d0bdd8010b4508e80747

  • SHA256

    bfe88e4229fb197c1b5d8791f068da0f7358b546df7325ec2e266f80a92bdb9b

  • SHA512

    a03ec6cb5567d3646d46348c19a250665742b5a4a59f376092fb9d53f7d2d7ab1b3f878948ee84d0d95cbba79e67788de441e38381eb13e8cd65e9b7312d6184

Score
10/10

Malware Config

Extracted

Family

remcos

C2

umuchu.hopto.org:2405

Targets

    • Target

      Authorization letter formatducsigned contract.js

    • Size

      236KB

    • MD5

      c9c780c8c5104c5b0dbabe46bcc3e0b7

    • SHA1

      e1ed4e375a527e0804a9d0bdd8010b4508e80747

    • SHA256

      bfe88e4229fb197c1b5d8791f068da0f7358b546df7325ec2e266f80a92bdb9b

    • SHA512

      a03ec6cb5567d3646d46348c19a250665742b5a4a59f376092fb9d53f7d2d7ab1b3f878948ee84d0d95cbba79e67788de441e38381eb13e8cd65e9b7312d6184

    Score
    10/10
    • Remcos

      Remcos is a closed-source remote control and surveillance software.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks