Overview

overview

10

Static

static

3

cd748ade3e...18.exe

windows7-x64

10

cd748ade3e...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cd748ade3eff33111ca21fb55affdff7_JaffaCakes118

  • Size

    830KB

  • Sample

    240831-x8f7ta1enj

  • MD5

    cd748ade3eff33111ca21fb55affdff7

  • SHA1

    c3e27733fe98e935ac64069095fd665b27fd53d0

  • SHA256

    3359753006097912e587ebde35140efeee739514850ddc62f8bc232afb504a06

  • SHA512

    93c379a71d131d4a00215eb1e504e52f53dca88668ff63cd14f183e470f6cb2e816795011ccc4f2c1d27992d9ef829fdf9ed211b6d53950ae8f5b2d691d24f36

  • SSDEEP

    24576:f2O/GlFjmOFuZMABoXrOCLs2lQlZP69CK:ui/loXuri9z

Score
10/10
remcosdiscoverypersistencerat

Malware Config

Targets

    • Target

      cd748ade3eff33111ca21fb55affdff7_JaffaCakes118

    • Size

      830KB

    • MD5

      cd748ade3eff33111ca21fb55affdff7

    • SHA1

      c3e27733fe98e935ac64069095fd665b27fd53d0

    • SHA256

      3359753006097912e587ebde35140efeee739514850ddc62f8bc232afb504a06

    • SHA512

      93c379a71d131d4a00215eb1e504e52f53dca88668ff63cd14f183e470f6cb2e816795011ccc4f2c1d27992d9ef829fdf9ed211b6d53950ae8f5b2d691d24f36

    • SSDEEP

      24576:f2O/GlFjmOFuZMABoXrOCLs2lQlZP69CK:ui/loXuri9z

    Score
    10/10
    remcosdiscoverypersistencerat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks