Overview

overview

10

Static

static

5a96079f_b...is.exe

windows7_x64

8

5a96079f_b...is.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5a96079f_by_Libranalysis

  • Size

    721KB

  • Sample

    210510-sen25sp2rj

  • MD5

    5a96079fd1ed632e3afa017e210518a5

  • SHA1

    b62b48677bdf7ae841d7aff5d2053e268ec679e0

  • SHA256

    ba743ef93625025018dfc47978452d19503cee81e2adc2cd71ac0a173b3e2513

  • SHA512

    ce9bf669f76a42380337dc2faa9632b1ee6f7faaeb3f818d80bdd7572388592358c868a63abeb8643d686f4cb5534e59647ec820af243ae319e4afc1268b8fe7

Score
10/10
remcospersistencerat

Malware Config

Extracted

Family

remcos

C2

prayerarequesttojah.ddns.net:4344

Targets

    • Target

      5a96079f_by_Libranalysis

    • Size

      721KB

    • MD5

      5a96079fd1ed632e3afa017e210518a5

    • SHA1

      b62b48677bdf7ae841d7aff5d2053e268ec679e0

    • SHA256

      ba743ef93625025018dfc47978452d19503cee81e2adc2cd71ac0a173b3e2513

    • SHA512

      ce9bf669f76a42380337dc2faa9632b1ee6f7faaeb3f818d80bdd7572388592358c868a63abeb8643d686f4cb5534e59647ec820af243ae319e4afc1268b8fe7

    Score
    10/10
    persistenceremcosrat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks