General

  • Target

    b08e045217a374f32b7b6de7866d1171_JaffaCakes118

  • Size

    912KB

  • Sample

    240820-ycr5watdkm

  • MD5

    b08e045217a374f32b7b6de7866d1171

  • SHA1

    fe42e68d9a98c8019f13c74e73200c1a61996140

  • SHA256

    9e31830230743fbd8374a2894cbbd4f10d2d91a4d08dde374d79aad92ceb247b

  • SHA512

    8d74115fc6b23744f72090b2ea3830a02aebce00cdc155ba6587ad2d30a4bce1390637aef925b8d348ba2cb0cb03d07251d4ed921d1c38e109c6c0fbaacdee51

  • SSDEEP

    24576:2oJZiJX4zzYYj4vj+2wcIzOaJrXbKymhetfnZDvno:zEeYA4vj5yX9uyWIw

Malware Config

Extracted

Family

remcos

Version

3.1.0 Pro

Botnet

RemoteHost

C2

sandshoe.myfirewall.org:2404

sandshoe.myfirewall.org:2403

anti-vi.duckdns.org:2404

Attributes
  • audio_folder

    MicRecords

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    svchost.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    true

  • install_path

    %AppData%

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    Remcos-9X4RSG

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

  • take_screenshot_title

    wikipedia;solitaire;

Targets

    • Target

      73a4f40d0affe5eea89174f8917bba73.exe

    • Size

      910KB

    • MD5

      1bf2f660917d980012006b0f8c152c31

    • SHA1

      82a54961994ff2b1ef7bec9fd467a327df2b582c

    • SHA256

      42ef2a340b9b5ec88d5ab83584f07ecc76e7b3842640aecd328ad9d85ad745e8

    • SHA512

      a3c9040b4d388c21215cd278969fd718917ff7bf7592c3583499084dd206e62471d33bd7281a3882deb1e7d1bdb8a4dd6e0bec501bb41017e76054992fbd96a6

    • SSDEEP

      24576:joJZiJX4zzYYj4vj+2wcIzOaJrXbKymhetfnZDvno:AEeYA4vj5yX9uyWIw

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks