General
-
Target
a2464b4f4778466af3de6f08818eb602_JaffaCakes118
-
Size
932KB
-
Sample
240612-zh3n8stbnm
-
MD5
a2464b4f4778466af3de6f08818eb602
-
SHA1
141ba4d2db10fe970ee728ac83ae9f63f161f6fb
-
SHA256
ed0ded65dc5d136c854016cb11989e7ca33b453fdf04596aa9e81242c103755e
-
SHA512
368fd63cfd6ea0099db79ee0bbb13d72630a943a136144810dffac82c776f4ef77dca2d059207dffdb33881ec24ec11991fdba47033c81cccf992f5b6e9f383d
-
SSDEEP
24576:IEAnRvATRmw1luw+JWNT+irshqTuSkXfw99Tdvvv:Ix6TIC+iT+icqTmAdvv
Malware Config
Extracted
remcos
2.0.7 Pro
RemoteHost
trustkemi.duckdns.org:4000
-
audio_folder
audio
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
5
-
copy_file
remcos.exe
-
copy_folder
remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Remcos-3W7ZZG
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Extracted
netwire
trustkemi.duckdns.org:8070
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
0x53F13A2E
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
offline_keylogger
true
-
password
231father@
-
registry_autorun
false
-
use_mutex
false
Targets
-
-
Target
a2464b4f4778466af3de6f08818eb602_JaffaCakes118
-
Size
932KB
-
MD5
a2464b4f4778466af3de6f08818eb602
-
SHA1
141ba4d2db10fe970ee728ac83ae9f63f161f6fb
-
SHA256
ed0ded65dc5d136c854016cb11989e7ca33b453fdf04596aa9e81242c103755e
-
SHA512
368fd63cfd6ea0099db79ee0bbb13d72630a943a136144810dffac82c776f4ef77dca2d059207dffdb33881ec24ec11991fdba47033c81cccf992f5b6e9f383d
-
SSDEEP
24576:IEAnRvATRmw1luw+JWNT+irshqTuSkXfw99Tdvvv:Ix6TIC+iT+icqTmAdvv
Score10/10-
AdWind
A Java-based RAT family operated as malware-as-a-service.
-
Class file contains resources related to AdWind
-
NetWire RAT payload
-
Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
-
Remcos
Remcos is a closed-source remote control and surveillance software.
-
Sets file execution options in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Modifies file permissions
-
Adds Run key to start application
-
Drops file in System32 directory
-