General
-
Target
e94d1201ad65f892af77db199ec96d46_JaffaCakes118
-
Size
481KB
-
Sample
240918-rk7f7swejj
-
MD5
e94d1201ad65f892af77db199ec96d46
-
SHA1
c8edbdc81a06d30fa13ec747587e5d7c62565cef
-
SHA256
b564e4c8f28fb518982189d031f651fd033e4d8e7970088c642a3b8c652a9acc
-
SHA512
b3826ee5b7ff3ab54846236e98f2a6b5f30b651c3592ae517d4feec3163a94ea69c6e81ad10430e116521895e41699d4ce25bcffbb63a0796ea3f96f331450d3
-
SSDEEP
12288:bPSbGTS0a3ESKPCjIZq8ratAKuv+/PopVuEV2mvV:bPk0a3CCUAAKuIPopVuO
Static task
static1
Behavioral task
behavioral1
Sample
7eec14e7cec4dc93fbf53e08998b2340.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
7eec14e7cec4dc93fbf53e08998b2340.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
remcos
2.7.2 Pro
RemoteHost
sandshoe.myfirewall.org:2404
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
svchosts.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
true
-
install_flag
true
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Remcos-DOPZNX
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
wikipedia;solitaire;
Targets
-
-
Target
7eec14e7cec4dc93fbf53e08998b2340.exe
-
Size
480KB
-
MD5
e12fd7343aae44cf9ba75d87754a51ad
-
SHA1
0d4aa92ae887175f42095a578337457875736536
-
SHA256
ac03de9eb86c038c61523da3b2e8e8d6748f6f45762e44564547f96df37acbe4
-
SHA512
b9325b2052f886a1b7de67d7819961a53542b7cbaabbd6edd872184230849d46f78be63b68aa9d89117795b10194bb07014fbaf7d31e803687a37cfc73b83b8b
-
SSDEEP
12288:lPSbGTS0a3ESKPCjIZq8ratAKuv+/PopVuEV2mvV:lPk0a3CCUAAKuIPopVuO
Score10/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-