Overview

overview

10

Static

static

5

d358b84a8f...18.exe

windows7-x64

3

d358b84a8f...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d358b84a8f0a32cf18b381e0c742d5ce_JaffaCakes118

  • Size

    977KB

  • Sample

    240908-c6q9sazhlk

  • MD5

    d358b84a8f0a32cf18b381e0c742d5ce

  • SHA1

    4cd803db44f520fefaf126c0173da90b7b4917ce

  • SHA256

    8b4e75273b80e80c8da0b961babd27d1e357d7f3710330de71e0c846ed51dae7

  • SHA512

    227f13f1d57bbaa1f4d8b6f583d9c743c4aa2726aa24b88d20157bbf0c0f15a50f892f155dd943c383eac3f15d38702e15b00688f71f8326482ef37f0ef02a73

  • SSDEEP

    24576:SAHnh+eWsN3skA4RV1Hom2KXMmHaM5B3wl5:Vh+ZkldoPK8YaML3G

Score
10/10
remcos17042019discoveryratupx

Malware Config

Extracted

Family

remcos

Version

2.4.3 Pro

Botnet

17042019

C2

jkamani.xyz:8246

Attributes
  • audio_folder

    MicRecords

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    3

  • copy_file

    remcos.exe

  • copy_folder

    remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • install_path

    %AppData%

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    Remcos-56T1Q9

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

  • take_screenshot_title

    wikipedia;solitaire;

Targets

    • Target

      d358b84a8f0a32cf18b381e0c742d5ce_JaffaCakes118

    • Size

      977KB

    • MD5

      d358b84a8f0a32cf18b381e0c742d5ce

    • SHA1

      4cd803db44f520fefaf126c0173da90b7b4917ce

    • SHA256

      8b4e75273b80e80c8da0b961babd27d1e357d7f3710330de71e0c846ed51dae7

    • SHA512

      227f13f1d57bbaa1f4d8b6f583d9c743c4aa2726aa24b88d20157bbf0c0f15a50f892f155dd943c383eac3f15d38702e15b00688f71f8326482ef37f0ef02a73

    • SSDEEP

      24576:SAHnh+eWsN3skA4RV1Hom2KXMmHaM5B3wl5:Vh+ZkldoPK8YaML3G

    Score
    10/10
    discoveryremcos17042019ratupx

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Drops startup file

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks