General
-
Target
e62f3a9fcde2987b30418db6aee857db_JaffaCakes118
-
Size
702KB
-
Sample
240408-agf2eaag4z
-
MD5
e62f3a9fcde2987b30418db6aee857db
-
SHA1
2e7278a0538398e3d1c7d4291595732b4c9579c2
-
SHA256
0d9fb244ea506b9994b55ca4fcf970cda40af79c08ea8f7bd1e34ce2c283cfd0
-
SHA512
838809fac6bb7826190754f65f90abe6c9191cb5628d25650f4c6ead9a7598ca2fa565fbacc33d1ce11e8a2149699f35489a0ef3b58da7f0a92da843ddd78918
-
SSDEEP
12288:tBSNFFsatyGKue/Qd6NlbBVNqdOTtb6/eF+IwCPp2hMLyrsYz:tBS7WzGg/fHbBVNqsbODcpOdgYz
Static task
static1
Behavioral task
behavioral1
Sample
e62f3a9fcde2987b30418db6aee857db_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e62f3a9fcde2987b30418db6aee857db_JaffaCakes118.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
remcos
3.1.5 Pro
RemoteHost
namsgee.duckdns.org:7642
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
true
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
true
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Remcos-9NXZPD
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
notepad;solitaire;
Targets
-
-
Target
e62f3a9fcde2987b30418db6aee857db_JaffaCakes118
-
Size
702KB
-
MD5
e62f3a9fcde2987b30418db6aee857db
-
SHA1
2e7278a0538398e3d1c7d4291595732b4c9579c2
-
SHA256
0d9fb244ea506b9994b55ca4fcf970cda40af79c08ea8f7bd1e34ce2c283cfd0
-
SHA512
838809fac6bb7826190754f65f90abe6c9191cb5628d25650f4c6ead9a7598ca2fa565fbacc33d1ce11e8a2149699f35489a0ef3b58da7f0a92da843ddd78918
-
SSDEEP
12288:tBSNFFsatyGKue/Qd6NlbBVNqdOTtb6/eF+IwCPp2hMLyrsYz:tBS7WzGg/fHbBVNqsbODcpOdgYz
Score10/10-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-