Overview

overview

10

Static

static

3

68da20c81f...18.exe

windows7-x64

10

68da20c81f...18.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    68da20c81fba9c4c59b2979f38894352_JaffaCakes118

  • Size

    204KB

  • Sample

    240522-2dzg5abd68

  • MD5

    68da20c81fba9c4c59b2979f38894352

  • SHA1

    4a1a2640746caafbf84e804142a7b6368b2c1338

  • SHA256

    133e21e07ea5741c212b8ca181b61e6255cc5c9412d7f83baa18d7eb90c2db18

  • SHA512

    18ce9e01bb07567602cd43c834f43d63f20881b9f02dcda86139abed013959d8a8990b4df7ad1992ac375a93658b663ad37a312f0ecbf5be102a2151fb66dfce

  • SSDEEP

    6144:BpG4ONMNrtop6hoKNSyJD3O+Uk9qjE4k:BU7NMNr+GNZJDDUk9mb

Score
10/10
remcosmarzo2019rat

Malware Config

Extracted

Family

remcos

Version

2.2.2 Pro

Botnet

MARZO2019

C2

casillas.hicam.net:2404

casillasmx.chickenkiller.com:2404

casillas.libfoobar.so:2404

du4alr0ute.sendsmtp.com:2404

settings.wifizone.org:2404

wifi.con-ip.com:2404

rsaupdatr.jumpingcrab.com:2404

activate.office-on-the.net:2404
Attributes
  • audio_folder

    audio

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    5

  • copy_file

    remcos.exe

  • copy_folder

    REM20

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • install_path

    %AppData%

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    EQHR

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    MARZ02019-RDUOXY

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    1

  • startup_value

    remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      68da20c81fba9c4c59b2979f38894352_JaffaCakes118

    • Size

      204KB

    • MD5

      68da20c81fba9c4c59b2979f38894352

    • SHA1

      4a1a2640746caafbf84e804142a7b6368b2c1338

    • SHA256

      133e21e07ea5741c212b8ca181b61e6255cc5c9412d7f83baa18d7eb90c2db18

    • SHA512

      18ce9e01bb07567602cd43c834f43d63f20881b9f02dcda86139abed013959d8a8990b4df7ad1992ac375a93658b663ad37a312f0ecbf5be102a2151fb66dfce

    • SSDEEP

      6144:BpG4ONMNrtop6hoKNSyJD3O+Uk9qjE4k:BU7NMNr+GNZJDDUk9mb

    Score
    10/10
    remcosmarzo2019rat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Drops startup file

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks