Overview

overview

10

Static

static

Trust Duo ...33.exe

windows7_x64

10

Trust Duo ...33.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Trust Duo Medicate Invoice_93838376389389363738938737633.exe

  • Size

    704KB

  • Sample

    210510-ksrlzsjgna

  • MD5

    7119c9e0e31551124c125d714e35bd1d

  • SHA1

    628a5b9fd78e6d1d64eb7132aa84c017b0a6ca42

  • SHA256

    c3ce62a44812edeca97182d5f26639b222ebe684021e7a7b922a499bd32d7f95

  • SHA512

    300c2520745bc8b7ce839df746e9fba002b5c2e36c7d2837647975db8389e9b4ea944ee5f7163c80d273e51d2f9e8e84559f09f018d16d457470a73801e4f085

Score
10/10
modiloaderremcospersistencerattrojan

Malware Config

Extracted

Family

remcos

C2

216.38.7.225:6524

Targets

    • Target

      Trust Duo Medicate Invoice_93838376389389363738938737633.exe

    • Size

      704KB

    • MD5

      7119c9e0e31551124c125d714e35bd1d

    • SHA1

      628a5b9fd78e6d1d64eb7132aa84c017b0a6ca42

    • SHA256

      c3ce62a44812edeca97182d5f26639b222ebe684021e7a7b922a499bd32d7f95

    • SHA512

      300c2520745bc8b7ce839df746e9fba002b5c2e36c7d2837647975db8389e9b4ea944ee5f7163c80d273e51d2f9e8e84559f09f018d16d457470a73801e4f085

    Score
    10/10
    remcospersistenceratmodiloadertrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks