remcos

General

Target
2021fec8feb356edbcea0588a270cb6b_JaffaCakes118
Size 234KB
Sample240702-vmv3qssfja
SHA256 918dede163276d652ee3fc92b2ec93733850b27a31339e6e972536d168990506
MD5 2021fec8feb356edbcea0588a270cb6b
SHA1 2e1ff93fe5da8c89508ff5f1aa44d641e25b6823
SHA512 2598edb08e125bea4016c44385b29c244f24914fdcdc07546c599e3caf68346bd511853ca1422d4ba9019c21c16ccc33201f6495b9c4a22769df1ff33d4d82c2
SSDEEP 3072:yBkfJpRXATwMdFCcM6FbyDiEDlL1UPhrXiTWddkDdvXIYCZ9gn/TOnG7kUeOp+L2:yqjIGQyDid5ryTWdAIRrgrlk++LbH9Et
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

remcos

Version

2.7.2 Pro

Botnet

Excel-logs

C2

103.114.106.35:20987

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
Excel.exe
copy_folder
Excel
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
true
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
Excel
keylog_path
%AppData%
mouse_option
false
mutex
Excel-KW0C5C
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Excel
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
wikipedia;solitaire;

Targets

- Target
  2021fec8feb356edbcea0588a270cb6b_JaffaCakes118
- Size 234KB
- SHA256 918dede163276d652ee3fc92b2ec93733850b27a31339e6e972536d168990506
- MD5 2021fec8feb356edbcea0588a270cb6b
- SHA1 2e1ff93fe5da8c89508ff5f1aa44d641e25b6823
- SHA512 2598edb08e125bea4016c44385b29c244f24914fdcdc07546c599e3caf68346bd511853ca1422d4ba9019c21c16ccc33201f6495b9c4a22769df1ff33d4d82c2
- SSDEEP 3072:yBkfJpRXATwMdFCcM6FbyDiEDlL1UPhrXiTWddkDdvXIYCZ9gn/TOnG7kUeOp+L2:yqjIGQyDid5ryTWdAIRrgrlk++LbH9Et
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

remcos excel-logs persistence rat
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e
- MD5 fccff8cb7a1067e23fd2e2b63971a8e1
- SHA1 30e2a9e137c1223a78a0f7b0bf96a1c361976d91
- SHA512 f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c
- SSDEEP 192:xPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4v:g7VpNo8gmOyRsVc4
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral3 behavioral4
- Target
  0jxlr2n3sx9a9r.dll
- Size 13KB
- SHA256 238727a5364853abf73decbd56c4c1e3f3906060e802352b547a296e34dd3646
- MD5 9ec36c1f7989533c81de064104ea35ab
- SHA1 9a9f608e7bf4e4f06e4804f7b132939d3ee5654d
- SHA512 bfb31fd814d2069cf529297c9c4ec4b8d6480012ccbc8f0ea013ce750705d953e47f00f6fa625b95c94c1bcde6763612a6055f91a35428eed0f1e16c6b1bb2e7
- SSDEEP 192:hRg35IFoT8RdxD2I9fWJDbHifEePOZEyIDcseAFMbUsE80I/uCg:IIbCMedaBQ3sfFMZE806
- MD5 SHA1 SHA512 SSDEEP
Score

6^/10

persistence
- Adds Run key to start application
  persistence
behavioral5 behavioral6