Overview

overview

10

Static

static

3

c36a27c853...18.exe

windows7-x64

10

c36a27c853...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_399702a7764a1873f9e9ae078afd0cdb18346c44f971d9d930d97da5b15fe721

  • Size

    994KB

  • Sample

    241230-fs5rssyqdr

  • MD5

    23001a9acb60115d1d73f778aadfe9db

  • SHA1

    2945b985310a225937d3acc9aca468483b0abb85

  • SHA256

    399702a7764a1873f9e9ae078afd0cdb18346c44f971d9d930d97da5b15fe721

  • SHA512

    f6e98b87d91d1ff35c418678fff4354d429149dfc52e8de4c47a6d0a08d2581f806cbcf63ceecbb6e028d4ce910cb8707449c810ae1ab092d36a4575fe7fc38d

  • SSDEEP

    24576:wwk3qeq4i0NZAAh79QE/wBOp31We8Flha6:wtvXbX7KE/wI4eej

Score
10/10
remcosnoondiscoveryexecutionrat

Malware Config

Extracted

Family

remcos

Botnet

noon

C2

79.134.225.121:1200

Attributes
  • audio_folder

    MicRecords

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • install_path

    %AppData%

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    Remcos-6F12P7

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

  • take_screenshot_title

    notepad;solitaire;

Targets

    • Target

      c36a27c853f9b925df2fd90972ca2eda0c2bcacbce37eb404b05ca306b731a18

    • Size

      1.1MB

    • MD5

      d961a05e5efceee1b56c46d392c7407f

    • SHA1

      7d179a2e17b72f02e8480d68a750c7b9c83e3cd1

    • SHA256

      c36a27c853f9b925df2fd90972ca2eda0c2bcacbce37eb404b05ca306b731a18

    • SHA512

      15110ae42fe92ba8cb4438c9aea1d20952a78856e8f2c0da7da5913f41b083238674219903589dcecce2c2b65bdd9940e823d291ff840a93429457f80962fdd1

    • SSDEEP

      24576:r30Vvkk49eS8w0K1CrZOecyCvRChKUmLG2:r344ww0K1CrQecyzRmLG

    Score
    10/10
    remcosnoondiscoveryexecutionrat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Remcos family

      remcos

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks