Overview

overview

10

Static

static

3

f1a4ef4fbc...18.exe

windows7-x64

1

f1a4ef4fbc...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f1a4ef4fbce540f67061dbe829ceb5d3_JaffaCakes118

  • Size

    1.3MB

  • Sample

    240415-whq4naeg8x

  • MD5

    f1a4ef4fbce540f67061dbe829ceb5d3

  • SHA1

    44fcab47b0ccc49ff0ede26322abcf977ab9e204

  • SHA256

    d338f6946cd36d7d216945bf63e07ed0cda1983a2296b6f4f1a8b4e9a892346a

  • SHA512

    597c2202d8edd7d33a97497ad4ae90e5419d6cc96a99849cc153dd203be711d46ffe251cd333ea13434dc69f548fe61b11b3219c036ba45e148d45abe1e3a488

  • SSDEEP

    24576:aWOUJmUty0V17eIKZh7UgwcEU0JYxi4WMq:aWlJmCvhiw1HYxi9Mq

Score
10/10
remcosremotehostagilenetrat

Malware Config

Extracted

Family

remcos

Version

3.3.0 Pro

Botnet

RemoteHost

C2

wealthlyblessed.ddns.net:39200

Attributes
  • audio_folder

    MicRecords

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • install_path

    %AppData%

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    Remcos-83QLZO

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

  • take_screenshot_title

    notepad;solitaire;

Targets

    • Target

      f1a4ef4fbce540f67061dbe829ceb5d3_JaffaCakes118

    • Size

      1.3MB

    • MD5

      f1a4ef4fbce540f67061dbe829ceb5d3

    • SHA1

      44fcab47b0ccc49ff0ede26322abcf977ab9e204

    • SHA256

      d338f6946cd36d7d216945bf63e07ed0cda1983a2296b6f4f1a8b4e9a892346a

    • SHA512

      597c2202d8edd7d33a97497ad4ae90e5419d6cc96a99849cc153dd203be711d46ffe251cd333ea13434dc69f548fe61b11b3219c036ba45e148d45abe1e3a488

    • SSDEEP

      24576:aWOUJmUty0V17eIKZh7UgwcEU0JYxi4WMq:aWlJmCvhiw1HYxi9Mq

    Score
    10/10
    remcosremotehostagilenetrat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

      agilenet

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks