General

  • Target

    24f8d198ac1e805095589cc19d6c9229_JaffaCakes118

  • Size

    560KB

  • Sample

    240508-qcf4lsgd63

  • MD5

    24f8d198ac1e805095589cc19d6c9229

  • SHA1

    8f8d6cc9b83d008d2a6d1e9fcd455efef1b0db64

  • SHA256

    73f15b77fcecec7fe5aa1d12323b973aa228331e5cac271252ba85773f105fa8

  • SHA512

    51b09e268386be4b906a8e0b3dc15dfe765696f62715c45e00375b43e7b14fad331fcd8fe84a4a463d487c2969fd00c992bcab53db76b0655d6fe7f9210fab46

  • SSDEEP

    6144:47qiC8RH5N2HpqqMKdpv+HONAhiH5Q/ASTBn2ZXZP6n5UmLy6:EC8RqEsrWHONAhiHS/ASTV2ZXZin2

Score
10/10

Malware Config

Targets

    • Target

      24f8d198ac1e805095589cc19d6c9229_JaffaCakes118

    • Size

      560KB

    • MD5

      24f8d198ac1e805095589cc19d6c9229

    • SHA1

      8f8d6cc9b83d008d2a6d1e9fcd455efef1b0db64

    • SHA256

      73f15b77fcecec7fe5aa1d12323b973aa228331e5cac271252ba85773f105fa8

    • SHA512

      51b09e268386be4b906a8e0b3dc15dfe765696f62715c45e00375b43e7b14fad331fcd8fe84a4a463d487c2969fd00c992bcab53db76b0655d6fe7f9210fab46

    • SSDEEP

      6144:47qiC8RH5N2HpqqMKdpv+HONAhiH5Q/ASTBn2ZXZP6n5UmLy6:EC8RqEsrWHONAhiHS/ASTV2ZXZin2

    Score
    10/10
    • Remcos

      Remcos is a closed-source remote control and surveillance software.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks