Overview

overview

10

Static

static

3

629d38d0c6...18.exe

windows7-x64

10

629d38d0c6...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    629d38d0c61e23e9d39c5db2025d7af9_JaffaCakes118

  • Size

    552KB

  • Sample

    240521-j3vw5aea88

  • MD5

    629d38d0c61e23e9d39c5db2025d7af9

  • SHA1

    38ace980d763fcbc1c2138afa5a34c8bb7581ed7

  • SHA256

    b694796fc38e342bdf4593d134779a1e89d03159b563b6814e61962e0de5dc66

  • SHA512

    c66ba44be783c951a7eb9e979c0e9bc6a816b6e53580d6cd7a6d05ed41cfbfef42a51c8f749c54c30bc23615346c6989733acf272ea168c16d03b43388cc70b3

  • SSDEEP

    6144:IaSW1ZCyTunR7VrZSKeXW5qnHoUOle+0lXQFlFyc/AypM1BEvh9ECjtXhalRQ6jm:IBWdanROG4IF70gEcDW1BWhOCjZYQym

Score
10/10
remcospersistencerat

Malware Config

Targets

    • Target

      629d38d0c61e23e9d39c5db2025d7af9_JaffaCakes118

    • Size

      552KB

    • MD5

      629d38d0c61e23e9d39c5db2025d7af9

    • SHA1

      38ace980d763fcbc1c2138afa5a34c8bb7581ed7

    • SHA256

      b694796fc38e342bdf4593d134779a1e89d03159b563b6814e61962e0de5dc66

    • SHA512

      c66ba44be783c951a7eb9e979c0e9bc6a816b6e53580d6cd7a6d05ed41cfbfef42a51c8f749c54c30bc23615346c6989733acf272ea168c16d03b43388cc70b3

    • SSDEEP

      6144:IaSW1ZCyTunR7VrZSKeXW5qnHoUOle+0lXQFlFyc/AypM1BEvh9ECjtXhalRQ6jm:IBWdanROG4IF70gEcDW1BWhOCjZYQym

    Score
    10/10
    remcospersistencerat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks