Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    e62c6746f84f89027d8924786fbe3280_JaffaCakes118

  • Size

    893KB

  • Sample

    240917-gkl56axgkn

  • MD5

    e62c6746f84f89027d8924786fbe3280

  • SHA1

    1b5c55ebe31f1588d0d677e81d68bb11a48be894

  • SHA256

    1dacdded73c4cf1270303e47ce3f12a5acdf7881eea7487231115e2be20aea5f

  • SHA512

    4233989e6594ab17d20d2d9b7397552e652028ab99b081fde885067904d0e949e564a5d9131dcd5a4b2a2cc3573437047dc29d0bfb385e88b8685f203001cb99

  • SSDEEP

    12288:qBtwEru0VeNlhjfdF+/gKzfYIPI/Lj9tjAYpGo9pIt+9Hc+S2VLgxVQFt9M6sDPE:qNolhRczxILj3AVoIF2h+Cnbs7E

Malware Config

Extracted

Family

remcos

Version

3.1.0 Pro

Botnet

RemoteHost

C2

berryttttiere.duckdns.org:6553

asddskfjjer.duckdns.org:6553

Attributes
  • audio_folder

    MicRecords

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    true

  • install_path

    %AppData%

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    Remcos-Q3VG56

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

  • take_screenshot_title

    wikipedia;solitaire;

Targets

    • Target

      e62c6746f84f89027d8924786fbe3280_JaffaCakes118

    • Size

      893KB

    • MD5

      e62c6746f84f89027d8924786fbe3280

    • SHA1

      1b5c55ebe31f1588d0d677e81d68bb11a48be894

    • SHA256

      1dacdded73c4cf1270303e47ce3f12a5acdf7881eea7487231115e2be20aea5f

    • SHA512

      4233989e6594ab17d20d2d9b7397552e652028ab99b081fde885067904d0e949e564a5d9131dcd5a4b2a2cc3573437047dc29d0bfb385e88b8685f203001cb99

    • SSDEEP

      12288:qBtwEru0VeNlhjfdF+/gKzfYIPI/Lj9tjAYpGo9pIt+9Hc+S2VLgxVQFt9M6sDPE:qNolhRczxILj3AVoIF2h+Cnbs7E

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.