Overview

overview

10

Static

static

10

c446746efb...18.rtf

windows7-x64

10

c446746efb...18.rtf

windows10-2004-x64

4

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c446746efb2f1adcbfa66f98fa4b5dca_JaffaCakes118

  • Size

    773KB

  • Sample

    240827-dy98cszhpd

  • MD5

    c446746efb2f1adcbfa66f98fa4b5dca

  • SHA1

    20f57f4eb6cf358af82cbc4bb18433063b6f263e

  • SHA256

    954fb1de84898cdaeacaf0c48a252497884888ac9b11347f1428bb543689e8c2

  • SHA512

    030cc485d8033c21a194a103d214ea1d4438360fb1aee194c2845464a245ca7449bd6e994cc443faa0d6685bbfdae261e5a0069dc1daa65d206b355ba307875b

  • SSDEEP

    12288:CxrQXRas40+CzMfUdokNlaJPSFOSdbrAC:Cx8Bar0lCzJaIYbrAC

Score
10/10
remcosdefense_evasiondiscoveryrat

Malware Config

Targets

    • Target

      c446746efb2f1adcbfa66f98fa4b5dca_JaffaCakes118

    • Size

      773KB

    • MD5

      c446746efb2f1adcbfa66f98fa4b5dca

    • SHA1

      20f57f4eb6cf358af82cbc4bb18433063b6f263e

    • SHA256

      954fb1de84898cdaeacaf0c48a252497884888ac9b11347f1428bb543689e8c2

    • SHA512

      030cc485d8033c21a194a103d214ea1d4438360fb1aee194c2845464a245ca7449bd6e994cc443faa0d6685bbfdae261e5a0069dc1daa65d206b355ba307875b

    • SSDEEP

      12288:CxrQXRas40+CzMfUdokNlaJPSFOSdbrAC:Cx8Bar0lCzJaIYbrAC

    Score
    10/10
    remcosdefense_evasiondiscoveryrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks