Overview

overview

10

Static

static

3

e8f3b6078e...18.exe

windows7-x64

10

e8f3b6078e...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e8f3b6078e6629f2f9e0ccff6074df39_JaffaCakes118

  • Size

    244KB

  • Sample

    240918-mxlm2swgjg

  • MD5

    e8f3b6078e6629f2f9e0ccff6074df39

  • SHA1

    77f477758e2f646f66664be70e99da9dff71a02a

  • SHA256

    1224fa13afd1f551b4400cf7c6e35da7d686824e3e9191ee8714d620660c5fbb

  • SHA512

    5d7a65fe447d3297fecafbac8f815295d2de7fefe2b9053a3f22464b351c5e4bc2abb76a13ed1e2760f7b4354fa49813b800a99a478c859bec7cfb77fe4d9f77

  • SSDEEP

    6144:4BQ+48EIY22Fy+154GSlz9kBCFJETm7KBTdYEvf5q/jveLu:4BN48E/54xlz9kAmBfYEA/bgu

Score
10/10
remcosdiscoveryrat

Malware Config

Targets

    • Target

      e8f3b6078e6629f2f9e0ccff6074df39_JaffaCakes118

    • Size

      244KB

    • MD5

      e8f3b6078e6629f2f9e0ccff6074df39

    • SHA1

      77f477758e2f646f66664be70e99da9dff71a02a

    • SHA256

      1224fa13afd1f551b4400cf7c6e35da7d686824e3e9191ee8714d620660c5fbb

    • SHA512

      5d7a65fe447d3297fecafbac8f815295d2de7fefe2b9053a3f22464b351c5e4bc2abb76a13ed1e2760f7b4354fa49813b800a99a478c859bec7cfb77fe4d9f77

    • SSDEEP

      6144:4BQ+48EIY22Fy+154GSlz9kBCFJETm7KBTdYEvf5q/jveLu:4BN48E/54xlz9kAmBfYEA/bgu

    Score
    10/10
    remcosdiscoveryrat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks