Overview

overview

10

Static

static

Ver PDF es...ar.exe

windows7_x64

10

Ver PDF es...ar.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Ver PDF estado de cuentas y confirmar Ver PDF estado de cuentas y confirmar.exe

  • Size

    550KB

  • Sample

    210423-tky96r8hte

  • MD5

    6cfd8918e9b9511f8d7fcc93308011eb

  • SHA1

    c9be2597c17d8b4daac89b9f7aa76e330c7e8bf3

  • SHA256

    fb119105227d38bf4e5acbc6a5dc5abfeabbbcfb3b32d635c940510293554e26

  • SHA512

    73efd2d0b3876eaef362d542a6a8aeb76762d4465eda9a86106c63ca6b5bc008e49432d5f465b8c8069d895abf5e6d7fab4591488f3d3e613234f82cbb91f005

Score
10/10
remcosrat

Malware Config

Extracted

Family

remcos

C2

covid19remoc.duckdns.org:1013

Targets

    • Target

      Ver PDF estado de cuentas y confirmar Ver PDF estado de cuentas y confirmar.exe

    • Size

      550KB

    • MD5

      6cfd8918e9b9511f8d7fcc93308011eb

    • SHA1

      c9be2597c17d8b4daac89b9f7aa76e330c7e8bf3

    • SHA256

      fb119105227d38bf4e5acbc6a5dc5abfeabbbcfb3b32d635c940510293554e26

    • SHA512

      73efd2d0b3876eaef362d542a6a8aeb76762d4465eda9a86106c63ca6b5bc008e49432d5f465b8c8069d895abf5e6d7fab4591488f3d3e613234f82cbb91f005

    Score
    10/10
    remcosrat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks