General

  • Target

    REVISED ORDER 2322020.EXE

  • Size

    1.1MB

  • Sample

    210223-5133fc361a

  • MD5

    7da140a904417492363f4418cb2a717b

  • SHA1

    a06673b6a33f804a3f9f688231d30e1edf5378d4

  • SHA256

    e4eb73c0e476457f54c9e3a5df6b25ef839e3aac74465ca666c2b2c0bcaaa1f7

  • SHA512

    d75dba2342c80bed03d956f428947ec3e80b9e9423570eebf77c810a3671b728e76106baae606edbef8b96096c1d66165ee43967b2563e1170eb998813e5e03a

Score
10/10

Malware Config

Extracted

Family

remcos

C2

marstonstyl247.ddns.net:3234

Targets

    • Target

      REVISED ORDER 2322020.EXE

    • Size

      1.1MB

    • MD5

      7da140a904417492363f4418cb2a717b

    • SHA1

      a06673b6a33f804a3f9f688231d30e1edf5378d4

    • SHA256

      e4eb73c0e476457f54c9e3a5df6b25ef839e3aac74465ca666c2b2c0bcaaa1f7

    • SHA512

      d75dba2342c80bed03d956f428947ec3e80b9e9423570eebf77c810a3671b728e76106baae606edbef8b96096c1d66165ee43967b2563e1170eb998813e5e03a

    Score
    10/10
    • Remcos

      Remcos is a closed-source remote control and surveillance software.

    • Adds Run key to start application

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Tasks