Overview

overview

10

Static

static

SOA_IN_APR...DF.exe

windows7_x64

6

SOA_IN_APR...DF.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SOA_IN_APRIL_2021._CARGO.CHINA_PDF.exe

  • Size

    721KB

  • Sample

    210510-ej3k8gy952

  • MD5

    c110b7d722e09fb92c3c5bb96a606ac5

  • SHA1

    25d1851b878f22bc4b8fd27909a24b56a49cb669

  • SHA256

    40dc655d06780c3f628f6ec2c3848d797c8ba88dcc50e3397e4e464ec12aaade

  • SHA512

    9bad63aab7af6ef2201545fbb886ec45c3c53b3febeb28c38ba3e78cbafbc9bdfa6edfe1752d30d2917d233cb0e2e97ac54139d38d153b5aa9f415faaaced4ca

Score
10/10
remcospersistencerat

Malware Config

Extracted

Family

remcos

C2

newserversforlogs2.ddns.net:8692

Targets

    • Target

      SOA_IN_APRIL_2021._CARGO.CHINA_PDF.exe

    • Size

      721KB

    • MD5

      c110b7d722e09fb92c3c5bb96a606ac5

    • SHA1

      25d1851b878f22bc4b8fd27909a24b56a49cb669

    • SHA256

      40dc655d06780c3f628f6ec2c3848d797c8ba88dcc50e3397e4e464ec12aaade

    • SHA512

      9bad63aab7af6ef2201545fbb886ec45c3c53b3febeb28c38ba3e78cbafbc9bdfa6edfe1752d30d2917d233cb0e2e97ac54139d38d153b5aa9f415faaaced4ca

    Score
    10/10
    persistenceremcosrat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks