Overview

overview

10

Static

static

3

e03d79bc3c...18.exe

windows7-x64

10

e03d79bc3c...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e03d79bc3ccdb3ab8eb0ec4d7beb5e54_JaffaCakes118

  • Size

    272KB

  • Sample

    240914-p998aavhqc

  • MD5

    e03d79bc3ccdb3ab8eb0ec4d7beb5e54

  • SHA1

    ce6da1698033378c09c962c4596c26799c1a92da

  • SHA256

    06aaccfece6cbee1fe3287ce2d6accd9b60931c585f54a4c400b280ced6567a3

  • SHA512

    add7e1f8ea7afbf0f12571a4001fe9bbb7446c6df7a862bdfe94c99f006e0c5abfdabe5ea9430bad377d5dfb5cdb3a6258fcf771490cf31a10df53141e438396

  • SSDEEP

    3072:MJxZrh6l6K6S5ryGn7lBzb2wyLTULV8DzCmAH0Mb6VajOxej6ZHs5tp6xh:Mlh8XZnPP2wIOa2mU0/VajKyp6

Score
10/10
remcosdiscoverypersistencerat

Malware Config

Targets

    • Target

      e03d79bc3ccdb3ab8eb0ec4d7beb5e54_JaffaCakes118

    • Size

      272KB

    • MD5

      e03d79bc3ccdb3ab8eb0ec4d7beb5e54

    • SHA1

      ce6da1698033378c09c962c4596c26799c1a92da

    • SHA256

      06aaccfece6cbee1fe3287ce2d6accd9b60931c585f54a4c400b280ced6567a3

    • SHA512

      add7e1f8ea7afbf0f12571a4001fe9bbb7446c6df7a862bdfe94c99f006e0c5abfdabe5ea9430bad377d5dfb5cdb3a6258fcf771490cf31a10df53141e438396

    • SSDEEP

      3072:MJxZrh6l6K6S5ryGn7lBzb2wyLTULV8DzCmAH0Mb6VajOxej6ZHs5tp6xh:Mlh8XZnPP2wIOa2mU0/VajKyp6

    Score
    10/10
    remcosdiscoverypersistencerat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks