General

  • Target

    960c0e89ff21f1f41604dc89cdf300c7_JaffaCakes118

  • Size

    769KB

  • Sample

    240814-pb8a2awdkj

  • MD5

    960c0e89ff21f1f41604dc89cdf300c7

  • SHA1

    8731fb9683915331ccb77ca0ffc6821d635d85a8

  • SHA256

    04c93fd4c4b9ede9c3661f17dfed1ebc4ac3d09b4ad724b6c9e39dc189c1205e

  • SHA512

    da06518821980dbd3fe804f0991af35afcd7f500783a2a882c3f25e9d6c24e6e156aaef76a2b12c3b931939afb88b1aaf7d058e117dca6a5e0ad083c279e581b

  • SSDEEP

    12288:VGxEFHhPv61ig2j78AmhnBllHJtJMjeYjzJ2zKRd9lZs:UgP+28AMDNJ0jegzgo

Malware Config

Extracted

Family

remcos

Version

3.0.2 Pro

Botnet

RemoteHost

C2

176.111.174.14:2804

Attributes
  • audio_folder

    MicRecords

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • install_path

    %AppData%

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    Remcos-77IWIS

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

  • take_screenshot_title

    wikipedia;solitaire;

Targets

    • Target

      960c0e89ff21f1f41604dc89cdf300c7_JaffaCakes118

    • Size

      769KB

    • MD5

      960c0e89ff21f1f41604dc89cdf300c7

    • SHA1

      8731fb9683915331ccb77ca0ffc6821d635d85a8

    • SHA256

      04c93fd4c4b9ede9c3661f17dfed1ebc4ac3d09b4ad724b6c9e39dc189c1205e

    • SHA512

      da06518821980dbd3fe804f0991af35afcd7f500783a2a882c3f25e9d6c24e6e156aaef76a2b12c3b931939afb88b1aaf7d058e117dca6a5e0ad083c279e581b

    • SSDEEP

      12288:VGxEFHhPv61ig2j78AmhnBllHJtJMjeYjzJ2zKRd9lZs:UgP+28AMDNJ0jegzgo

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks