Overview

overview

10

Static

static

10

jaffacakes...zy.exe

windows10-2004-x64

10

jaffacakes...zy.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    jaffacakes118_Trojan-Spy.Win32.Noon.wzy.94ebd819ff64a76e927a5801062d0c25
  • Size 573KB
  • Sample261012-lzt7jay19k
  • SHA256 0d742ae858d2ca650d07ab9ccbd55aae7180c01cf64e7a6abd700ba2d6d81f00
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
guloaderremcosdiscoverydownloaderexecutionpersistencerat

Malware Config

Extracted

Family

  • remcos

Version

  • 2.0.9 Pro

C2

  • 185.148.241.49:1949

Targets

    • Target
      jaffacakes118_Trojan-Spy.Win32.Noon.wzy.94ebd819ff64a76e927a5801062d0c25
    • Size 573KB
    • SHA256 0d742ae858d2ca650d07ab9ccbd55aae7180c01cf64e7a6abd700ba2d6d81f00
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    discoverydownloaderexecutionguloaderremcospersistencerat

    • Family: Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Family: Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Executes a VBScript file via the Windows Script Host.

      execution

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks