General
-
Target
b57b4436c43f4d4b4a3a712fcf565131_JaffaCakes118
-
Size
1.1MB
-
Sample
240821-3h127azgpj
-
MD5
b57b4436c43f4d4b4a3a712fcf565131
-
SHA1
14bffa8b68f3584c4de768981d2caf27080b9512
-
SHA256
14ead0d8d6087d6758fcdf8a3e80e69b49fe918f34ce23cea8f26e76190f2a62
-
SHA512
fbe802c0df0183c063c15da7f373d7bf2ef2049bf2f2ad91f3275c37cde9bfa9959fa87a8cd8d166b5e0b40b90145fdaa2b6c48f8a0446b3401adc79c57496e6
-
SSDEEP
24576:pi8sJVF8xC73zk+KVFfY84h4/31eX5dFPDunuIIPeq+8myf:pi8cCxp1Qfh4/65dFSnJq+8myf
Static task
static1
Behavioral task
behavioral1
Sample
b57b4436c43f4d4b4a3a712fcf565131_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
b57b4436c43f4d4b4a3a712fcf565131_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
remcos
3.1.0 Pro
RemoteHost
45.137.22.45:5200
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Remcos-ZJK1W9
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
wikipedia;solitaire;
Targets
-
-
Target
b57b4436c43f4d4b4a3a712fcf565131_JaffaCakes118
-
Size
1.1MB
-
MD5
b57b4436c43f4d4b4a3a712fcf565131
-
SHA1
14bffa8b68f3584c4de768981d2caf27080b9512
-
SHA256
14ead0d8d6087d6758fcdf8a3e80e69b49fe918f34ce23cea8f26e76190f2a62
-
SHA512
fbe802c0df0183c063c15da7f373d7bf2ef2049bf2f2ad91f3275c37cde9bfa9959fa87a8cd8d166b5e0b40b90145fdaa2b6c48f8a0446b3401adc79c57496e6
-
SSDEEP
24576:pi8sJVF8xC73zk+KVFfY84h4/31eX5dFPDunuIIPeq+8myf:pi8cCxp1Qfh4/65dFSnJq+8myf
Score10/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-