Overview

overview

10

Static

static

3

e8951f0b49...18.exe

windows7-x64

10

e8951f0b49...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e8951f0b49eee256fdcb275a30d1a6c7_JaffaCakes118

  • Size

    229KB

  • Sample

    240918-hz84xaycnb

  • MD5

    e8951f0b49eee256fdcb275a30d1a6c7

  • SHA1

    ecd7f7876661260590cc8a25865956a4efac6190

  • SHA256

    2f7713ce0b410ed8219c81d07ad4040f0d3f1adc51e11deab38228465ee286de

  • SHA512

    748258cc90792b254be9c1a9313a23ec3383300a750e8c25492d848c302eb05dc90aa6ba40fdfcdf1541caea5c7f8d8d66dd71ccdfb94eb05a1c030f867cc1f0

  • SSDEEP

    3072:uWp+PekE+cqyB5vkEcMTm3LvuPso6ZJe/dLdkgXmKMl8+FPGVJXZsjEgYzFcFe:Xp+bp+EiPsoueLTXQ8dslY

Score
10/10
remcoshostdiscoveryrat

Malware Config

Extracted

Family

remcos

Version

1.7 Pro

Botnet

Host

C2

pmanz.sytes.net:444

Attributes
  • audio_folder

    audio

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    5

  • copy_file

    remcos.exe

  • copy_folder

    remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • install_path

    %AppData%

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    remcos_ffrcbsjpmc

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screens

  • screenshot_path

    %AppData%

  • screenshot_time

    1

  • startup_value

    remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      e8951f0b49eee256fdcb275a30d1a6c7_JaffaCakes118

    • Size

      229KB

    • MD5

      e8951f0b49eee256fdcb275a30d1a6c7

    • SHA1

      ecd7f7876661260590cc8a25865956a4efac6190

    • SHA256

      2f7713ce0b410ed8219c81d07ad4040f0d3f1adc51e11deab38228465ee286de

    • SHA512

      748258cc90792b254be9c1a9313a23ec3383300a750e8c25492d848c302eb05dc90aa6ba40fdfcdf1541caea5c7f8d8d66dd71ccdfb94eb05a1c030f867cc1f0

    • SSDEEP

      3072:uWp+PekE+cqyB5vkEcMTm3LvuPso6ZJe/dLdkgXmKMl8+FPGVJXZsjEgYzFcFe:Xp+bp+EiPsoueLTXQ8dslY

    Score
    10/10
    remcoshostdiscoveryrat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks