Overview

overview

10

Static

static

3

e7d3639283...18.exe

windows7-x64

10

e7d3639283...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e7d36392836c350b47e1e485465f2446_JaffaCakes118

  • Size

    648KB

  • Sample

    240917-2f4vmayelj

  • MD5

    e7d36392836c350b47e1e485465f2446

  • SHA1

    b4cfaca779557d14cbccf09accefaf4ec8cec30e

  • SHA256

    e037f166b8e3066f5b8fc2f4dea6cf0d052dde5234b46c81e3d5ecf73dc713c2

  • SHA512

    c6f530cbfcf8d145e06c7850b1c51f2dc9efbd893229d12a2fe035be89d3c32979c803f4122f77278aa7d3595f70b99cd3fb867adeaea51fbafbaae7d265a3a1

  • SSDEEP

    6144:DHtgbfyyNili9mp2kS4/JfrtkXl5w5R0koDQY1/rIPpGV8eY2M:TtcK+iEJ6RraXfwBoUY1/r8KB

Score
10/10
remcosdiscoverypersistencerat

Malware Config

Targets

    • Target

      e7d36392836c350b47e1e485465f2446_JaffaCakes118

    • Size

      648KB

    • MD5

      e7d36392836c350b47e1e485465f2446

    • SHA1

      b4cfaca779557d14cbccf09accefaf4ec8cec30e

    • SHA256

      e037f166b8e3066f5b8fc2f4dea6cf0d052dde5234b46c81e3d5ecf73dc713c2

    • SHA512

      c6f530cbfcf8d145e06c7850b1c51f2dc9efbd893229d12a2fe035be89d3c32979c803f4122f77278aa7d3595f70b99cd3fb867adeaea51fbafbaae7d265a3a1

    • SSDEEP

      6144:DHtgbfyyNili9mp2kS4/JfrtkXl5w5R0koDQY1/rIPpGV8eY2M:TtcK+iEJ6RraXfwBoUY1/r8KB

    Score
    10/10
    remcosdiscoverypersistencerat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks