Overview

overview

10

Static

static

10

6172d523e7...18.exe

windows7-x64

10

6172d523e7...18.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6172d523e7d0677101201d4532cf0098_JaffaCakes118

  • Size

    108KB

  • Sample

    240521-aq69yscc32

  • MD5

    6172d523e7d0677101201d4532cf0098

  • SHA1

    b3077ec85cbb03f0548379745d30c535b8ae72a6

  • SHA256

    2c620195dddbd080bff652a08fe7287023cb27ffe8418a2bbc478dad376b63b8

  • SHA512

    67cbc7af916a4c4f4c10591f54cd37613ebecba9afb94795c2608a62e0e5cc626273ad13ecb14a6265b9940bf5973ef8bf88d52be6ea4187f97ea9281feb5e5e

  • SSDEEP

    3072:eFNUcekHxRkuHxSWMDUajQJf/p/itxBCBpEzImXnZvHI+zIcEUrp5:eHUcLxRkuRSWMDUaGf/p/sxWpEzImXZn

Score
10/10
remcosremotehostrat

Malware Config

Extracted

Family

remcos

Version

2.0.5 Pro

Botnet

RemoteHost

C2

79.172.242.28:2404

Attributes
  • audio_folder

    audio

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    5

  • copy_file

    remcos.exe

  • copy_folder

    remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • install_path

    %AppData%

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    Remcos-6PPTSU

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      6172d523e7d0677101201d4532cf0098_JaffaCakes118

    • Size

      108KB

    • MD5

      6172d523e7d0677101201d4532cf0098

    • SHA1

      b3077ec85cbb03f0548379745d30c535b8ae72a6

    • SHA256

      2c620195dddbd080bff652a08fe7287023cb27ffe8418a2bbc478dad376b63b8

    • SHA512

      67cbc7af916a4c4f4c10591f54cd37613ebecba9afb94795c2608a62e0e5cc626273ad13ecb14a6265b9940bf5973ef8bf88d52be6ea4187f97ea9281feb5e5e

    • SSDEEP

      3072:eFNUcekHxRkuHxSWMDUajQJf/p/itxBCBpEzImXnZvHI+zIcEUrp5:eHUcLxRkuRSWMDUaGf/p/sxWpEzImXZn

    Score
    10/10
    remcosremotehostrat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks