remcos | ea101a8c59b929dcd4ab6ba676550784_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
ea101a8c59b929dcd4ab6ba676550784_JaffaCakes118
Size 416KB
Sample240409-qe9tpsfg98
SHA256 757f55304e084b41d1dd4747dfdf71657e6ed0561ab87d098809d2ddf87f348b
MD5 ea101a8c59b929dcd4ab6ba676550784
SHA1 bc11240922a3f0550092bdfade41449e0d7e65f6
SHA512 28a2374f6039029a70cf31cf236d84c613691c541730a6d8c0c8c24cefe3102f62baf3e7609e9ebedf93c3c1dc044922418181e7d1bdff0a6716376a44c04218
SSDEEP 6144:6VOFpfTNHxOQCh9u96DncKfZqEcIJVLYww89yIRAOU+/XpcBDcBlOk:6VOFpbNhCy6wvEBJVkwLjq+Rc2Ok
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remotehost remcos

Malware Config

Extracted

Family

remcos

Version

3.3.0 Light

Botnet

RemoteHost

10.0.2.15:2404

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-8XTGZ6
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
notepad;solitaire;

Signatures

Remcos family
remcos

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ea101a8c59b929dcd4ab6ba676550784_JaffaCakes118

File Explorer

ea101a8c59b929dcd4ab6ba676550784_JaffaCakes118

.exe 416KB

ea101a8c59b929dcd4ab6ba676550784_JaffaCakes118

IMPHASH 5ae30bdce3bbe82747ace747f7836c56
SHA256 757f55304e084b41d1dd4747dfdf71657e6ed0561ab87d098809d2ddf87f348b
MD5 ea101a8c59b929dcd4ab6ba676550784
SHA1 bc11240922a3f0550092bdfade41449e0d7e65f6
SHA512 28a2374f6039029a70cf31cf236d84c613691c541730a6d8c0c8c24cefe3102f62baf3e7609e9ebedf93c3c1dc044922418181e7d1bdff0a6716376a44c04218
SSDEEP 6144:6VOFpfTNHxOQCh9u96DncKfZqEcIJVLYww89yIRAOU+/XpcBDcBlOk:6VOFpbNhCy6wvEBJVkwLjq+Rc2Ok
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

170644

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetProcAddress VirtualProtect SetLastError VirtualFree VirtualAlloc GetNativeSystemInfo HeapAlloc GetProcessHeap FreeLibrary IsBadReadPtr GetCurrentProcess GlobalAlloc GlobalLock GetCurrentProcessId GetTickCount GlobalUnlock LocalAlloc GlobalFree MulDiv SizeofResource GetLongPathNameW RemoveDirectoryW FindResourceA OpenProcess LockResource LoadResource LocalFree GetFileSize FormatMessageA GetModuleFileNameA lstrcpynA AllocConsole QueryPerformanceFrequency QueryPerformanceCounter Process32FirstW DeleteFileA InitializeCriticalSection DeleteCriticalSection HeapSize WriteConsoleW SetStdHandle SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExA ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetConsoleMode GetConsoleCP FlushFileBuffers GetFileType HeapReAlloc GetACP GetStdHandle GetModuleHandleExW MoveFileExW RtlUnwind LoadLibraryA Process32NextW CreateToolhelp32Snapshot GetLocaleInfoA GetModuleHandleA CreateMutexA ExitProcess SetFileAttributesW EnterCriticalSection GetModuleFileNameW GetLastError ExpandEnvironmentStringsA WaitForSingleObject FindNextFileA FindFirstFileA FindClose MoveFileW SetFilePointerEx GetLogicalDriveStringsA DeleteFileW GetFileAttributesW CreateFileW lstrlenA GetDriveTypeA FindNextFileW GetFileSizeEx FindFirstFileW CreateDirectoryW CreateProcessA Sleep PeekNamedPipe CreatePipe TerminateProcess WriteFile ReadFile HeapFree HeapCreate CreateEventA GetLocalTime CreateThread CloseHandle SetEvent CreateEventW LeaveCriticalSection RaiseException LoadLibraryExW GetCPInfo GetStringTypeW GetLocaleInfoW LCMapStringW CompareStringW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount MultiByteToWideChar DecodePointer EncodePointer WideCharToMultiByte InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent GetModuleHandleW WaitForSingleObjectEx ResetEvent SetEndOfFile

user32

EnumWindows ExitWindowsEx TranslateMessage DispatchMessageA GetMessageA EmptyClipboard CloseClipboard OpenClipboard ShowWindow GetClipboardData MessageBoxW IsWindowVisible CloseWindow GetWindowThreadProcessId SendInput mouse_event DrawIcon GetSystemMetrics GetIconInfo SetClipboardData SetForegroundWindow SetWindowTextW TrackPopupMenu SystemParametersInfoW GetForegroundWindow GetCursorPos CreatePopupMenu RegisterClassExA DefWindowProcA CreateWindowExA AppendMenuA GetWindowTextW

gdi32

SelectObject CreateCompatibleDC StretchBlt GetDIBits DeleteDC DeleteObject CreateDCA GetObjectA CreateCompatibleBitmap

advapi32

RegEnumValueW CryptAcquireContextA CryptGenRandom CryptReleaseContext GetUserNameW RegEnumKeyExA QueryServiceStatus CloseServiceHandle OpenSCManagerW OpenSCManagerA ControlService StartServiceW QueryServiceConfigW ChangeServiceConfigW OpenServiceW EnumServicesStatusW AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken RegCreateKeyA RegCloseKey RegQueryInfoKeyW RegQueryValueExA RegCreateKeyExW RegEnumKeyExW RegSetValueExW RegSetValueExA RegOpenKeyExA RegOpenKeyExW RegCreateKeyW RegDeleteValueW RegQueryValueExW RegDeleteKeyA

shell32

ShellExecuteW ShellExecuteExA Shell_NotifyIconA ExtractIconA

shlwapi

StrToIntA PathFileExistsW PathFileExistsA

winmm

PlaySoundW mciSendStringA mciSendStringW

ws2_32

htons gethostbyname WSAStartup closesocket WSAGetLastError recv connect socket send

urlmon

URLOpenBlockingStreamW URLDownloadToFileW

gdiplus

GdipAlloc GdipDisposeImage GdipFree GdipGetImageEncodersSize GdipLoadImageFromStream GdiplusStartup GdipGetImageEncoders GdipCloneImage GdipSaveImageToStream

Name

.text

Size

290KB

Virtual Size

290KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

88KB

Virtual Size

88KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

1024B

Virtual Size

560B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

19KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

ea101a8c59b929dcd4ab6ba676550784_JaffaCakes118

kernel32

user32

gdi32

advapi32

shell32

shlwapi

winmm

ws2_32

urlmon

gdiplus

generic