Overview

overview

10

Static

static

Remcos 1.7...ed.exe

windows7-x64

10

Remcos 1.7...ed.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Remcos 1.7 Full version Cracked.exe

  • Size

    13.2MB

  • Sample

    221024-pgb5sagdd3

  • MD5

    c00c09e7fa52bc19bd425d71e78ff4cb

  • SHA1

    2cd1a7130a03d4056454733b62e4667a08451262

  • SHA256

    9bb347dce075e62a7df2121b6f413769b564e0b58d4302a2372bedeac6a2880b

  • SHA512

    8d18238fe7c906ddd155b8af3a0d32604aeafaf352ab1947a07f273168740c5971083b157c7e21b74125a7e42d8684db5daba2cb3bc4971ca92f20949828a9d5

  • SSDEEP

    49152:LLxWP/6L37yMNw9R9ZG2ca1ZHk5lPkSMc/iZCFlM/B74CEpTQozIENbVQDVdI+0V:9

Score
10/10
njratsystempersistencetrojan

Malware Config

Extracted

Family

njrat

Version

v2.0

Botnet

System

C2

2.tcp.ngrok.io:13817

Mutex

Windows

Attributes
  • reg_key

    Windows

  • splitter

    |-F-|

Targets

    • Target

      Remcos 1.7 Full version Cracked.exe

    • Size

      13.2MB

    • MD5

      c00c09e7fa52bc19bd425d71e78ff4cb

    • SHA1

      2cd1a7130a03d4056454733b62e4667a08451262

    • SHA256

      9bb347dce075e62a7df2121b6f413769b564e0b58d4302a2372bedeac6a2880b

    • SHA512

      8d18238fe7c906ddd155b8af3a0d32604aeafaf352ab1947a07f273168740c5971083b157c7e21b74125a7e42d8684db5daba2cb3bc4971ca92f20949828a9d5

    • SSDEEP

      49152:LLxWP/6L37yMNw9R9ZG2ca1ZHk5lPkSMc/iZCFlM/B74CEpTQozIENbVQDVdI+0V:9

    Score
    10/10
    njratsystempersistencetrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Hidden Files and Directories

1
T1158

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Hidden Files and Directories

1
T1158

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks