Overview

overview

10

Static

static

3

Remcos Pro...22.zip

windows10-2004-x64

1

Remcos Pro...22.zip

windows11-21h2-x64

1

LICENSE

windows10-2004-x64

1

LICENSE

windows11-21h2-x64

1

Remcos Pro...le.ini

windows10-2004-x64

1

Remcos Pro...le.ini

windows11-21h2-x64

3

Remcos Pro...22.exe

windows10-2004-x64

10

Remcos Pro...22.exe

windows11-21h2-x64

10

Remcos Pro...gs.ini

windows10-2004-x64

1

Remcos Pro...gs.ini

windows11-21h2-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Remcos Professional Cracked By Alcatraz3222.zip

  • Size

    17.3MB

  • Sample

    240701-v23q5azgqc

  • MD5

    ea3fd7407073aae0205a02f10c1f826f

  • SHA1

    aeb5a674da5bbdea4e1b42470e6e059b730b88a6

  • SHA256

    bdb96b7a1a75fa4f56d1b1f922d80f029c12df21df49cbbfd1f2a3175d604195

  • SHA512

    bf69f80a585eed54b599cb5adf285ca0576650b275daef6e502eae2d564906950cb4a13821b67325bc1c2ba0ca6436401f562c279cc42d3590e0f8becfec028f

  • SSDEEP

    393216:2+Y8LpIcxbEWd4rSrwcJY2sG1l/TTwizV1iBLzCoa+++OvPrTy:/yMwWqrXc+G1l7TwiRI9z8++TTy

Score
10/10
njrathackedevasionpersistenceprivilege_escalationtrojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

dllsys.duckdns.org:3202

Mutex

3b570ffeeb3d34249b9a5ce0ee58a328

Attributes
  • reg_key

    3b570ffeeb3d34249b9a5ce0ee58a328

  • splitter

    svchost

Targets

    • Target

      Remcos Professional Cracked By Alcatraz3222.zip

    • Size

      17.3MB

    • MD5

      ea3fd7407073aae0205a02f10c1f826f

    • SHA1

      aeb5a674da5bbdea4e1b42470e6e059b730b88a6

    • SHA256

      bdb96b7a1a75fa4f56d1b1f922d80f029c12df21df49cbbfd1f2a3175d604195

    • SHA512

      bf69f80a585eed54b599cb5adf285ca0576650b275daef6e502eae2d564906950cb4a13821b67325bc1c2ba0ca6436401f562c279cc42d3590e0f8becfec028f

    • SSDEEP

      393216:2+Y8LpIcxbEWd4rSrwcJY2sG1l/TTwizV1iBLzCoa+++OvPrTy:/yMwWqrXc+G1l7TwiRI9z8++TTy

    Score
    1/10
    behavioral1behavioral2

    • Target

      LICENSE

    • Size

      1KB

    • MD5

      51541cec0c7da0308e08f3c27052fa0b

    • SHA1

      7c2d8a683140ccf267f7fcf78ced10f5264b4e98

    • SHA256

      8c706bf3a40b2d609d88a43e36a9e931e3c562790df0ccb121970714197c2286

    • SHA512

      01e5e3cc3384388e12f762bd2663e7bc0ca4b20cce377661c1137de45abeafc2647199894d01a5efe4455d5553dc26c2d3b7ddb693f84109de979593f18e8675

    Score
    1/10
    behavioral3behavioral4

    • Target

      Remcos Professional Cracked By Alcatraz3222/BuilderProfiles/DefaultProfile.ini

    • Size

      431B

    • MD5

      70cf32c1cda028515c3fb0801d3fc2ce

    • SHA1

      6ed08ecce9c55aeb9acaff6b52356e2ce4047d5d

    • SHA256

      87dc653fa7b6331ab8358a6b7490e9cf4d2cb036f706a92cdf1060ad2c8defa1

    • SHA512

      656d145347dd8ec219e2c618a605b44fe79592123e2a912106bc9603717e36e1277e950a8339668bbcde1992e887e9be0c473f62fe991e1c49e2a8ef679ac79c

    Score
    3/10
    behavioral5behavioral6

    • Target

      Remcos Professional Cracked By Alcatraz3222/Remcos Professional Cracked By Alcatraz3222.exe

    • Size

      17.7MB

    • MD5

      efc159c7cf75545997f8c6af52d3e802

    • SHA1

      b85bd368c91a13db1c5de2326deb25ad666c24c1

    • SHA256

      898ac001d0f6c52c1001c640d9860287fdf30a648d580e9f5dd15e2ef84ab18e

    • SHA512

      d06a432233dceb731defd53238971699fef201d0f9144ee50e5dd7d6620dfdd6c298d52618bf2c9feb0519574f4565fb0177b00fd8292768fbd8b85dd11e650d

    • SSDEEP

      393216:GYuGvp8EHb+in8f4Zg41+Q4AXf5ZZcyfHDMxVpSc+q+eOFxdx:3mqSi8fN4sAXfrZcyfo7p0eYHx

    Score
    10/10
    njrathackedevasionpersistenceprivilege_escalationtrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral7behavioral8

    • Target

      Remcos Professional Cracked By Alcatraz3222/Remcos_Settings.ini

    • Size

      881B

    • MD5

      a3468935e33e361cf94f4721ed4cb66d

    • SHA1

      c3b19ca8382534b2179940cabede8c6c952a9c06

    • SHA256

      b374af58c24b6085f64f979dab434643da39d0267a27975f396473327dc98c7d

    • SHA512

      c1caa0b9637a46187d54b2952db204182fad5a5324574949ce4db13bdb17624ccd8b3228eb9b2bcfe5851add2c5d2f586945e7264b1d1cd02d91acf1fd81583a

    Score
    3/10
    behavioral10behavioral9

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Credential Access

Discovery

System Information Discovery

4
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks