General

  • Target

    Contract_Documents_pdf.exe

  • Size

    719KB

  • Sample

    210508-qh22ngwc9n

  • MD5

    6e6d28191079ca5c04b0eab5b98cd076

  • SHA1

    83486f15158b67bf5c811cbfcd81f3aae42fcbcf

  • SHA256

    a0bb5a244b144a8e10087fd70a04580c3bb8c4c8add7da671a06f10020473004

  • SHA512

    3c4baa6d72afd5051e9f009084343ff1308ef76f8f15db00bb69ae6082c3dd96a0c2e129bbfd21199a9f76e5116166b429d9043d25ac12481b69107597fcee7a

Score
10/10

Malware Config

Extracted

Family

remcos

C2

abujafirms1.duckdns.org:12000

194.5.98.203:1988

Targets

    • Target

      Contract_Documents_pdf.exe

    • Size

      719KB

    • MD5

      6e6d28191079ca5c04b0eab5b98cd076

    • SHA1

      83486f15158b67bf5c811cbfcd81f3aae42fcbcf

    • SHA256

      a0bb5a244b144a8e10087fd70a04580c3bb8c4c8add7da671a06f10020473004

    • SHA512

      3c4baa6d72afd5051e9f009084343ff1308ef76f8f15db00bb69ae6082c3dd96a0c2e129bbfd21199a9f76e5116166b429d9043d25ac12481b69107597fcee7a

    Score
    10/10
    • Remcos

      Remcos is a closed-source remote control and surveillance software.

    • Adds Run key to start application

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Tasks