Overview

overview

10

Static

static

3

PROFORMA-A...df.exe

windows7-x64

10

PROFORMA-A...df.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_9e7777ce012fbc01a5172047ee65c37090c5353fa097a8e9b3e2cb698ada8bdf

  • Size

    469KB

  • Sample

    241230-xc64cstkej

  • MD5

    a2f5787d76402869c736f10f70956484

  • SHA1

    b422c770ca450b9b70971fb888991d40c9a4c3fe

  • SHA256

    9e7777ce012fbc01a5172047ee65c37090c5353fa097a8e9b3e2cb698ada8bdf

  • SHA512

    cbf2ed5c2b293c1363e72ad910b5c16ada1a41f0deab0462e248dcbbe29b82710e4a94664f1e3ddaed80e088dd5acddd0da8027e06b75681ffe69f8a70b313de

  • SSDEEP

    12288:CpNTO1/ZS9D6//rCt6q3SlNbypDDXZZFtQl:i222+t6VHbypHTF+

Score
10/10
remcosrun am 4 usdiscoveryrat

Malware Config

Extracted

Family

remcos

Version

2.7.2 Pro

Botnet

Run am 4 Us

C2

bigfish2345.ddns.net:8583

Attributes
  • audio_folder

    MicRecords

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • install_path

    %AppData%

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    Remcos-STH1F0

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

  • take_screenshot_title

    wikipedia;solitaire;

Targets

    • Target

      PROFORMA-AG899028299309,pdf.exe

    • Size

      605KB

    • MD5

      b6dea0dde2a8c9454ec7be52f988836f

    • SHA1

      1d14d589cb7a9dae380b9a744f8f344ec7d1ac53

    • SHA256

      e8770a2ea55bb36957d75953d67a2d6b740c79e2d3c9a18cff37edf02b76f1cc

    • SHA512

      200109b60d4a85ece501c32bc0fb9f244a401cb8d550d992edbe7db36478cf14ea137fbde36daa60f73f8b912f8db8a02d2688981fc0d2e8fcfa2d1eeca86a68

    • SSDEEP

      12288:HwyEr7szOVdbKqD8QjyX/77ZZpe7WLHqY3jeooNdY45OV:TFzO/bK0Wj7Be7AKmqNd1K

    Score
    10/10
    remcosrun am 4 usdiscoveryrat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Remcos family

      remcos

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks