Overview

overview

10

Static

static

3

(ASTRACO L...oc.exe

windows7-x64

10

(ASTRACO L...oc.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_eba5ea29f29169bff70c67736b6848b527625c758f7249333bf07cf07c9da7af

  • Size

    734KB

  • Sample

    241225-rrm15svmgz

  • MD5

    aae3a716790ad40d99922772ba266087

  • SHA1

    9a580c4aa56b37d94251669e17fd0eb9b5fe0922

  • SHA256

    eba5ea29f29169bff70c67736b6848b527625c758f7249333bf07cf07c9da7af

  • SHA512

    d551d1f1c745b6dad4c7debb723cf3659f27234e0ac07b6c7a0c571c09acf055a82a3ad852fb56175b035bf97c23acb608b7151ceb6d84986176c12eea29efa0

  • SSDEEP

    12288:HjMa0PrYqRIO6KWR8mqRPOI0bK+lNX4vyMskILWLVoK0nUaGmYf6lDU5WgWdNRJZ:HQaHHRC89XMPLq7UaqhsZ

Score
10/10
remcosrekohostdiscoveryrat

Malware Config

Extracted

Family

remcos

Botnet

ReKoHost

C2

eaidali.ddns.net:4784

Attributes
  • audio_folder

    MicRecords

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    true

  • install_flag

    false

  • install_path

    %AppData%

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    Remcos-KX8FWE

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

  • take_screenshot_title

    notepad;solitaire;

Targets

    • Target

      (ASTRACO LLC_QNTY ORDER &PRICE REQUEST_doc.exe

    • Size

      780KB

    • MD5

      d8bc7f0f2c13f4b01468fabd70052587

    • SHA1

      e24f28d5331ea1ea1d71aa52194de4bece819fde

    • SHA256

      642a2fa23060f4e4b092a682b248cc386f0ce0a2ee3b0ee2487d9a0b381dc8b9

    • SHA512

      b15e50927bcc31a87bfed919b2f505bbd251176dd1e4506d2450e0eb795e12c88eae7970f8dcd7c1c60f31d4a4cf30304fa544b6a4abc390b80592399e3d0db8

    • SSDEEP

      12288:5PrE0ZQQUWY2WAaWHO52FQqqRNVqeFII4rk61RuLMxyPi3AjSkv:NrEuUWYv3WHA2ubRDidP0MxN3s

    Score
    10/10
    remcosrekohostdiscoveryrat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Remcos family

      remcos

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks