General

  • Target

    189de19de5a0222d7796a33425f1f99b_JaffaCakes118

  • Size

    1.0MB

  • Sample

    241006-snqhjavele

  • MD5

    189de19de5a0222d7796a33425f1f99b

  • SHA1

    332b502d991bdbda3cf5a564cb7fa81b751b4ec2

  • SHA256

    ac63e6a70d5a7b867b798cd4a22db827d66c95f2506d1efdb49d2b6bf6d73aa8

  • SHA512

    30606d94250673daea5c52c1da56d3270ed62938c95c28f122e47406533c4fa2a7044bf7642e3f11e742d219af9d0ea56aac345777c992e59d272ef95821aff7

  • SSDEEP

    24576:WAOcZwlfJfvzligAyW0iwfhNQXNmrKFjElpW:czXzgaWzIrKFjMW

Malware Config

Extracted

Family

remcos

Version

2.7.2 Pro

Botnet

NEWYEAR

C2

cato.fingusti.club:6609

Attributes
  • audio_folder

    MicRecords

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • install_path

    %AppData%

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    Remcos-VHEUO4

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

  • take_screenshot_title

    wikipedia;solitaire;

Targets

    • Target

      189de19de5a0222d7796a33425f1f99b_JaffaCakes118

    • Size

      1.0MB

    • MD5

      189de19de5a0222d7796a33425f1f99b

    • SHA1

      332b502d991bdbda3cf5a564cb7fa81b751b4ec2

    • SHA256

      ac63e6a70d5a7b867b798cd4a22db827d66c95f2506d1efdb49d2b6bf6d73aa8

    • SHA512

      30606d94250673daea5c52c1da56d3270ed62938c95c28f122e47406533c4fa2a7044bf7642e3f11e742d219af9d0ea56aac345777c992e59d272ef95821aff7

    • SSDEEP

      24576:WAOcZwlfJfvzligAyW0iwfhNQXNmrKFjElpW:czXzgaWzIrKFjMW

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.