General

  • Target

    JaffaCakes118_db00ce1def9794a4f5533677848d58d84f6950c1f57572b877a591f4e5ba2dc2

  • Size

    1.2MB

  • Sample

    241222-zl7scsylhz

  • MD5

    ab4740d6fa74d2f58fb1007d1c5201f0

  • SHA1

    7806b6808051dfdfb40062aa4d9fa03e8e5abe50

  • SHA256

    db00ce1def9794a4f5533677848d58d84f6950c1f57572b877a591f4e5ba2dc2

  • SHA512

    56b09e70df5054b926c482ebeac6ecb94cae1fed7308d21f2d1b205e996bcb312f5134f18e10af4762c88be29e42bbbb7a801c12a5afa92acb1e5f5f944623f4

  • SSDEEP

    24576:vVrcCrH4dAYWnCy1s+ofn/fPvqAj7V74iYYIGkCAL7:vFYUCyCf3zjZz9IGkCG7

Malware Config

Extracted

Family

remcos

Botnet

FRESH PORT

C2

emarketinglatakva.ddns.net:9794

Attributes
  • audio_folder

    MicRecords

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • install_path

    %AppData%

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    Remcos-Z9DAML

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

  • take_screenshot_title

    notepad;solitaire;

Targets

    • Target

      cdc54d976ad3af85f5f268a0efd2f0e19fede6b0d2e11eed89d4b24fe98c5cd3

    • Size

      1.4MB

    • MD5

      79fc587b75385d13a0aefbb63b8f83a5

    • SHA1

      fa71271dfc2926c711a1adf676e42ba7ab5421fa

    • SHA256

      cdc54d976ad3af85f5f268a0efd2f0e19fede6b0d2e11eed89d4b24fe98c5cd3

    • SHA512

      217f0a63af9960e7ac5e705da10b675d0ee8573396d819aa7e013766cd34c292e1afa8439d6c55c9f35e003fb06eb5278c2e8340a966da8e1c8b2a36498aa08d

    • SSDEEP

      24576:QGnA++3gtc0rx4bYY8nwoTsSofnHZPvg4l7v7aeUYSikCqRy:6++3sOMwo6Z3zlzlBSikCk

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

    • Remcos family

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks