Overview

overview

10

Static

static

3

ed74e31637...18.exe

windows7-x64

1

ed74e31637...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118

  • Size

    877KB

  • Sample

    240411-p1h3fabg65

  • MD5

    ed74e3163746bae6e52a1b6fa73c6f60

  • SHA1

    2a35b7923dcfb0916a2e488a74ce52c6a1a19ae2

  • SHA256

    d68f7e5a5a110bba3d6212f601d08f5288b018172005becf7459fe20a9a49c18

  • SHA512

    fb4787b4a3b4d8aa189ea4bb48727f3b2a15470b82cbc6fedff8390a06feb8a9b0a826e13b1f98e4dc1e6d0143a6bbdf8fdb1698c9f0f470952a0855c995d351

  • SSDEEP

    12288:IHRdjF2If262FE3Y8r3zrtoH8EVeX9mgQlcYRrt/e9nY5hGOaW5q:orF2ImFE3YoDrCH8EW7+HkY5CW5

Score
10/10
remcosremotehostrat

Malware Config

Extracted

Family

remcos

Version

3.2.0 Pro

Botnet

RemoteHost

C2

185.140.53.139:2404

Attributes
  • audio_folder

    MicRecords

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • install_path

    %AppData%

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    Remcos-VT282N

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

  • take_screenshot_title

    notepad;solitaire;

Targets

    • Target

      ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118

    • Size

      877KB

    • MD5

      ed74e3163746bae6e52a1b6fa73c6f60

    • SHA1

      2a35b7923dcfb0916a2e488a74ce52c6a1a19ae2

    • SHA256

      d68f7e5a5a110bba3d6212f601d08f5288b018172005becf7459fe20a9a49c18

    • SHA512

      fb4787b4a3b4d8aa189ea4bb48727f3b2a15470b82cbc6fedff8390a06feb8a9b0a826e13b1f98e4dc1e6d0143a6bbdf8fdb1698c9f0f470952a0855c995d351

    • SSDEEP

      12288:IHRdjF2If262FE3Y8r3zrtoH8EVeX9mgQlcYRrt/e9nY5hGOaW5q:orF2ImFE3YoDrCH8EW7+HkY5CW5

    Score
    10/10
    remcosremotehostrat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks