Overview

overview

10

Static

static

3

419000b66f...d7.exe

windows7-x64

10

419000b66f...d7.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_c548170eee396cd9ffc197fb13bf8fcfc38c9098c56e8eff3548883f4fdccfb9

  • Size

    562KB

  • Sample

    241230-v4wetstmez

  • MD5

    7feea41df3487f3ebcb7626b1cfb5489

  • SHA1

    1954a3e7a2b77807743f44393ded9a545d9cf364

  • SHA256

    c548170eee396cd9ffc197fb13bf8fcfc38c9098c56e8eff3548883f4fdccfb9

  • SHA512

    340d6fa611bb5a1c056f81499059fd47d077a40f4b8f6350d9e51467d57eff3047002ad9b103fe806853a8db5b727367f5c059c8092ea3c09b62cd4ce5bb7f91

  • SSDEEP

    12288:3b9X6E97eNRqz3kt6rpScWv74/JvlCYSQwY43JjjgGY0lUSggpyzt:Z6E9atYpSZWvloQZ43JjFfg2W

Score
10/10
remcosportugaldiscoveryrat

Malware Config

Extracted

Family

remcos

Version

2.7.0 Pro

Botnet

PORTUGAL

C2

portugal16.duckdns.org:1717

Attributes
  • audio_folder

    MicRecords

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • install_path

    %AppData%

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    Remcos-V9MRM7

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

  • take_screenshot_title

    wikipedia;solitaire;

Targets

    • Target

      419000b66f04ce0f9b5b3b9f4825d4b68d21df27e99d02b483bd96aa240413d7

    • Size

      955KB

    • MD5

      66bc12a8ad1e13c3e6dd65bd6db4790a

    • SHA1

      61048635297de9edf916ab5c2bbeeac865cad997

    • SHA256

      419000b66f04ce0f9b5b3b9f4825d4b68d21df27e99d02b483bd96aa240413d7

    • SHA512

      0f9fe805f7926a686382da2acc24da889be640b1951eb1a68c4f853aca56e7f3b1ff13d213d419f18e64b49f7a1c38edec556e2531d89c44e02755b286cec1aa

    • SSDEEP

      12288:dNPjK8AQLVCuOIfT4+Fx3ro79vWISMbaYVhtV8on56HldggrhmupdaDgYXvHS:d5RLAxIT4+Fx7EFSUtV8

    Score
    10/10
    remcosportugaldiscoveryrat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Remcos family

      remcos

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks