Overview

overview

10

Static

static

3

38c2822b39...c6.exe

windows7-x64

10

38c2822b39...c6.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_ba4ca626b1c1aff1cd0f6888a8e06661ae7a8ba8590e434f8a64a54006646d08

  • Size

    965KB

  • Sample

    241226-v4h5hasphr

  • MD5

    7e799f79160a72fb8766eeeb5dd751a0

  • SHA1

    da3a8ccc5210be0c95cbbb58d47f11bd639e3730

  • SHA256

    ba4ca626b1c1aff1cd0f6888a8e06661ae7a8ba8590e434f8a64a54006646d08

  • SHA512

    b73a1ea2989836778327e59f5ac4b8de806ae54105922b9ee79d960b52e297ee39c8a7a9fec50e6d2c7d94ec615b3579eacac0be1ffbe4e89c1412c998966c53

  • SSDEEP

    12288:/e0JGq5ZRo3qKO2N6i0/l2CPaRDvvKjiEJexCR6m/wDofUcT/kKkk4TUVQi/w72o:hJGiowi0dbGrz8I7PA9kkkKwKDdJu0M

Score
10/10
remcosremotehostdiscoveryrat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

Attributes
  • audio_folder

    MicRecords

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • install_path

    %AppData%

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    zmscsc

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    wealth_n_blessings-00ZEU8

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

  • take_screenshot_title

    notepad;solitaire;

Targets

    • Target

      38c2822b3929fe567273c89ddbdc3fb49a750199cd795f36ad6dc29bb614e4c6

    • Size

      1.0MB

    • MD5

      4515fc0fa5dbe2324e6fb44635854e8e

    • SHA1

      a18fb476947eb042d05762b309ee15d47a75a204

    • SHA256

      38c2822b3929fe567273c89ddbdc3fb49a750199cd795f36ad6dc29bb614e4c6

    • SHA512

      7fbc20cb958c3919cd2628b96b187b5c64ae12e80fdb679b2bbe4e5ea4db27cb777a61ecfa82dbb01f77c9495a809c6b43756997e8f2530e226a78e5c1ec8289

    • SSDEEP

      24576:N94Euo0i0dxGxHsgxZid+0kIwSjdTwoIj:34E8xdxsJxZi9tr8oM

    Score
    10/10
    remcosremotehostdiscoveryrat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Remcos family

      remcos

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks