Overview

overview

10

Static

static

10

d4cbf28eb4...18.exe

windows7-x64

10

d4cbf28eb4...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d4cbf28eb47bd63c8259f6a229a37d8a_JaffaCakes118

  • Size

    120KB

  • Sample

    240908-t3ym5ayemc

  • MD5

    d4cbf28eb47bd63c8259f6a229a37d8a

  • SHA1

    c055580e85324a771369fb8f68aa6883f9b8893c

  • SHA256

    3c64ed631aa34dd243e321f39a0ad5ea40db7ad94152ce97e48c43bb52ed9fbd

  • SHA512

    79ce83edc584c2f99fd552e56ac0ae480b839292ed12e2e260d98c19d824f937d703ec285b2fa370c7a7b92b299fc790b114e42fd09a4c9645f062248db5de3b

  • SSDEEP

    3072:JFNUcekHxRkuHxSWMDUajQJf/p/itxBCBpEzImXnr+vHI+zIcdv2u1p:JHUcLxRkuRSWMDUaGf/p/sxWpEzImXqr

Score
10/10
remcosstealthkeep_v205discoverypersistencerat

Malware Config

Extracted

Family

remcos

Version

2.0.5 Pro

Botnet

StealthKeep_v205

C2

google.airdns.org:2297

Attributes
  • audio_folder

    audio

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    5

  • copy_file

    winupd205.exe

  • delete_file

    true

  • hide_file

    true

  • hide_keylog_file

    false

  • install_flag

    true

  • install_path

    %WinDir%\System32

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    winupd205-WYQAIF

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    scrshots

  • screenshot_path

    %UserProfile%

  • screenshot_time

    10

  • startup_value

    winupd205

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      d4cbf28eb47bd63c8259f6a229a37d8a_JaffaCakes118

    • Size

      120KB

    • MD5

      d4cbf28eb47bd63c8259f6a229a37d8a

    • SHA1

      c055580e85324a771369fb8f68aa6883f9b8893c

    • SHA256

      3c64ed631aa34dd243e321f39a0ad5ea40db7ad94152ce97e48c43bb52ed9fbd

    • SHA512

      79ce83edc584c2f99fd552e56ac0ae480b839292ed12e2e260d98c19d824f937d703ec285b2fa370c7a7b92b299fc790b114e42fd09a4c9645f062248db5de3b

    • SSDEEP

      3072:JFNUcekHxRkuHxSWMDUajQJf/p/itxBCBpEzImXnr+vHI+zIcdv2u1p:JHUcLxRkuRSWMDUaGf/p/sxWpEzImXqr

    Score
    10/10
    remcosstealthkeep_v205discoverypersistencerat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks