Overview

overview

10

Static

static

3

JaffaCakes...9e.exe

windows7-x64

10

JaffaCakes...9e.exe

windows10-2004-x64

7

$PLUGINSDIR/awjx.dll

windows7-x64

10

$PLUGINSDIR/awjx.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_b36937c3fefcd1df032ac2900df91e9e

  • Size

    662KB

  • Sample

    250108-3ty2za1nem

  • MD5

    b36937c3fefcd1df032ac2900df91e9e

  • SHA1

    bb494c6af0b07691596b0d08b2826a88d790349c

  • SHA256

    850e7fa559e58fcb57b7cd78f297ce077f1ecf6dd25d62ffccdbb00dbce86bfd

  • SHA512

    f0ec223982ca1a358c23d3d1d065bb93246bac2ceb3c4eb037e2a4b104ec6e6d7d1c5420895ee9e81e29b8920e620200b610458fe8c732d0ecec06328ea0b32c

  • SSDEEP

    12288:ptnlaPwq8HRQoWR87YSdEEYunKDLnWFcyCcPMweE9:PAKHyoWR87YSGWKXccDcPf9

Score
10/10
remcosdiscoveryrat

Malware Config

Targets

    • Target

      JaffaCakes118_b36937c3fefcd1df032ac2900df91e9e

    • Size

      662KB

    • MD5

      b36937c3fefcd1df032ac2900df91e9e

    • SHA1

      bb494c6af0b07691596b0d08b2826a88d790349c

    • SHA256

      850e7fa559e58fcb57b7cd78f297ce077f1ecf6dd25d62ffccdbb00dbce86bfd

    • SHA512

      f0ec223982ca1a358c23d3d1d065bb93246bac2ceb3c4eb037e2a4b104ec6e6d7d1c5420895ee9e81e29b8920e620200b610458fe8c732d0ecec06328ea0b32c

    • SSDEEP

      12288:ptnlaPwq8HRQoWR87YSdEEYunKDLnWFcyCcPMweE9:PAKHyoWR87YSGWKXccDcPf9

    Score
    10/10
    remcosdiscoveryrat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Remcos family

      remcos

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/awjx.dll

    • Size

      20KB

    • MD5

      213e480b87636c56a73a61de53f0c3c8

    • SHA1

      0425ea30b6ae2eca54a8e55e1b7950dc0f5c1412

    • SHA256

      f8c73afa54aeed213fe0f60b0f3fd7e95ad292941a1dcd7cb9d94dc3b0571637

    • SHA512

      7b326838f0a8a214a932f58c66a37b0d6c7972e0ec089f7528c34041b8891c4a4b71d99d7630ff5c4bcbca83cd2aa25b4e8da30bdb1755339aa7ee5d079a4d34

    • SSDEEP

      384:1MO3lld/IM9avqotPg761Zl4ODA23hN28BfYe:1v3lldQM9Gg21oOpzdV

    Score
    10/10
    remcosdiscoveryrat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Remcos family

      remcos

    • Suspicious use of SetThreadContext

    behavioral3behavioral4

MITRE ATT&CK Enterprise v15

Tasks