remcos | 6306a84af848d10856e8dc13e9d0000d32dcaa129be195ede37eadda4cd7e3f3 | Triage

Sharing

General

Target

afe3d8e88524538f78ed9ba5a6199f52_JaffaCakes118
Size

498KB
Sample

241129-jt3klstqev
MD5

afe3d8e88524538f78ed9ba5a6199f52
SHA1

3e5d65019e2a779a72c107f9c5619c13f00085bf
SHA256

6306a84af848d10856e8dc13e9d0000d32dcaa129be195ede37eadda4cd7e3f3
SHA512

1f4ab1052d6cd3c8ed4c70c13e43e20ab3d6652a89ddfa20a97639918b5dccde59911a90c3ee69aa9131fc8bb0c85a026dcb4ad9048886b3dbe0c512401f4760
SSDEEP

12288:ILPffRB7Yg1iBWgG/aeIo1qI6YGpD9FMRabhJ:ILnJB+G/aRIqvYGHFMRaNJ

Score

10^/10

remcos fud-my-ass discovery rat

Malware Config

Extracted

Family

remcos

Version

3.2.0 Light

Botnet

FUD-MY-ASS

C2

www.pakchoob.me:2404

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
true
install_flag
false
install_path
%AppData%
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
date
keylog_path
%AppData%
mouse_option
false
mutex
microsoft-DJ5JTY
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
notepad;solitaire;

Targets

- Target
  
  afe3d8e88524538f78ed9ba5a6199f52_JaffaCakes118
- Size
  
  498KB
- MD5
  
  afe3d8e88524538f78ed9ba5a6199f52
- SHA1
  
  3e5d65019e2a779a72c107f9c5619c13f00085bf
- SHA256
  
  6306a84af848d10856e8dc13e9d0000d32dcaa129be195ede37eadda4cd7e3f3
- SHA512
  
  1f4ab1052d6cd3c8ed4c70c13e43e20ab3d6652a89ddfa20a97639918b5dccde59911a90c3ee69aa9131fc8bb0c85a026dcb4ad9048886b3dbe0c512401f4760
- SSDEEP
  
  12288:ILPffRB7Yg1iBWgG/aeIo1qI6YGpD9FMRabhJ:ILnJB+G/aRIqvYGHFMRaNJ
Score

10^/10

remcos fud-my-ass discovery rat
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Remcos family
  remcos
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

remcosfud-my-assdiscoveryrat

behavioral2

remcosfud-my-assdiscoveryrat