General
-
Target
7024cd28d4a7ea90cfcdbdf1a8d7287e_JaffaCakes118
-
Size
242KB
-
Sample
240524-3exklafa98
-
MD5
7024cd28d4a7ea90cfcdbdf1a8d7287e
-
SHA1
f435f44873b3a58c3a0d4dd49796f41c17d4db08
-
SHA256
5744db104260134735390f73f8db18a3283957d0d25971163ea45ae7654ffe53
-
SHA512
9973079b5aab5d9b8479c822a1198a3327d6e006f4768916813f630e46279f619dbcd35527c628184f791415bb9cea1bb008abfc07dcb3d3f28af13980315600
-
SSDEEP
6144:uRonVqN4M2SoVWI8IScNKtw7zjPzeOvJnYsgIY:uKg4/SoVWI8IScNKtieOvB7gIY
Static task
static1
Behavioral task
behavioral1
Sample
7024cd28d4a7ea90cfcdbdf1a8d7287e_JaffaCakes118.exe
Resource
win7-20240221-en
Malware Config
Extracted
remcos
1.7 Pro
Host
pmanz.sytes.net:444
-
audio_folder
audio
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
5
-
copy_file
remcos.exe
-
copy_folder
remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
remcos_jyjlpacrfdsoono
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screens
-
screenshot_path
%AppData%
-
screenshot_time
1
-
startup_value
remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
-
Target
7024cd28d4a7ea90cfcdbdf1a8d7287e_JaffaCakes118
-
Size
242KB
-
MD5
7024cd28d4a7ea90cfcdbdf1a8d7287e
-
SHA1
f435f44873b3a58c3a0d4dd49796f41c17d4db08
-
SHA256
5744db104260134735390f73f8db18a3283957d0d25971163ea45ae7654ffe53
-
SHA512
9973079b5aab5d9b8479c822a1198a3327d6e006f4768916813f630e46279f619dbcd35527c628184f791415bb9cea1bb008abfc07dcb3d3f28af13980315600
-
SSDEEP
6144:uRonVqN4M2SoVWI8IScNKtw7zjPzeOvJnYsgIY:uKg4/SoVWI8IScNKtieOvB7gIY
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-