Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- * ID: 852
- * MalFamily: "Remcos"
- * MalScore: 10.0
- * File Name: "rat_c1bc60587353e61f9ed04b1269eb0afb.jpg"
- * File Size: 1064960
- * File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
- * SHA256: "fa9a94b32f7fa1e1e3eef63d3fb9003fda8d295e1f1a3e521691725e4c7da9f3"
- * MD5: "c1bc60587353e61f9ed04b1269eb0afb"
- * SHA1: "b8fa6fbd4d3d08c2a8b89460c9e7fd4e7094d962"
- * SHA512: "1ec653c03b257bfe1ba5fb08890d861d78bbc106fccb60668f007cfa5c28765eaeab7ee163f63c240387bcb2c240df42f029a4fafc18be59bbba1ceaa9718e0e"
- * CRC32: "3A83E124"
- * SSDEEP: "12288:3Mr6y90gD5M+gpgHDEkaNr4KhhbRG+0nrjrl+5cPFSqE+2Oy:Ny1adpylaVy+mZ+CMqE+25"
- * Process Execution:
- "jMSZCRubR.exe",
- "REMCOS~4.EXE",
- "FO.exe",
- "explorer.exe"
- * Executed Commands:
- "C:\\Users\\user\\AppData\\Local\\Temp\\IXP000.TMP\\REMCOS~4.EXE",
- "\"C:\\Users\\user\\Jos5\\FO.exe\"",
- "C:\\Users\\user\\Jos5\\FO.exe "
- * Signatures Detected:
- "Description": "SetUnhandledExceptionFilter detected (possible anti-debug)",
- "Details":
- "Description": "Behavioural detection: Executable code extraction",
- "Details":
- "Description": "Possible date expiration check, exits too soon after checking local time",
- "Details":
- "process": "REMCOS~4.EXE, PID 2228"
- "Description": "A process attempted to delay the analysis task.",
- "Details":
- "Process": "FO.exe tried to sleep 694 seconds, actually delayed analysis time by 0 seconds"
- "Description": "Reads data out of its own binary image",
- "Details":
- "self_read": "process: REMCOS~4.EXE, pid: 2228, offset: 0x00000000, length: 0x17e2f401"
- "Description": "Installs itself for autorun at Windows startup",
- "Details":
- "key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\wextract_cleanup0"
- "data": "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\user\\AppData\\Local\\Temp\\IXP000.TMP\\\""
- "file": "C:\\Windows\\win.ini"
- "file": "C:\\Windows\\win.ini"
- "Description": "CAPE detected the Remcos malware family",
- "Details":
- "Description": "File has been identified by 14 Antiviruses on VirusTotal as malicious",
- "Details":
- "FireEye": "Generic.mg.c1bc60587353e61f"
- "Cylance": "Unsafe"
- "Cybereason": "malicious.d4d3d0"
- "Invincea": "heuristic"
- "APEX": "Malicious"
- "F-Secure": "Trojan.TR/Dropper.Gen"
- "Paloalto": "generic.ml"
- "Jiangmin": "Trojan-PSW.Azorult.b"
- "Avira": "TR/Dropper.Gen"
- "Antiy-AVL": "TrojanArcBomb/Win32.Agent"
- "Endgame": "malicious (moderate confidence)"
- "Ikarus": "Trojan-Spy.Agent"
- "AVG": "FileRepMetagen Malware"
- "Qihoo-360": "HEUR/QVM20.1.A4BB.Malware.Gen"
- "Description": "Drops a binary and executes it",
- "Details":
- "binary": "C:\\Users\\user\\Jos5\\FO.exe"
- "binary": "C:\\Users\\user\\AppData\\Local\\Temp\\IXP000.TMP\\REMCOS~4.EXE"
- "Description": "Created network traffic indicative of malicious activity",
- "Details":
- "signature": "ET TROJAN Remcos RAT Checkin 23"
- * Started Service:
- * Mutexes:
- "CicLoadWinStaWinSta0",
- "Local\\MSCTF.CtfMonitorInstMutexDefault1",
- "Remcos_Mutex_Inj",
- "Remcos-HW1SL4"
- * Modified Files:
- "C:\\Users\\user\\AppData\\Local\\Temp\\IXP000.TMP\\TMP4351$.TMP",
- "C:\\Users\\user\\AppData\\Local\\Temp\\IXP000.TMP\\REMCOS~4.EXE",
- "C:\\Users\\user\\AppData\\Local\\Temp\\~DFEC39AEC1DFCAC8A6.TMP",
- "C:\\Windows\\win.ini",
- "C:\\Users\\user\\Jos5\\FO.exe",
- "C:\\Users\\user\\Jos5\\FO.vbs",
- "C:\\Users\\user\\AppData\\Local\\Temp\\~DF9B99B0324A132D3A.TMP"
- * Deleted Files:
- "C:\\Users\\user\\AppData\\Local\\Temp\\IXP000.TMP",
- "C:\\Users\\user\\AppData\\Local\\Temp\\IXP000.TMP\\REMCOS~4.EXE",
- "C:\\Users\\user\\AppData\\Local\\Temp\\IXP000.TMP\\"
- * Modified Registry Keys:
- "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\wextract_cleanup0",
- "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\CEBFF5CD-ACE2-4F4F-9178-9926F41749EA\\Count\\1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7\\pzq.rkr",
- "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\CEBFF5CD-ACE2-4F4F-9178-9926F41749EA\\Count\\HRZR_PGYFRFFVBA",
- "HKEY_CURRENT_USER\\Software\\Remcos-HW1SL4\\",
- "HKEY_CURRENT_USER\\Software\\Remcos-HW1SL4\\exepath",
- "HKEY_CURRENT_USER\\Software\\Remcos-HW1SL4\\licence"
- * Deleted Registry Keys:
- "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\wextract_cleanup0"
- * DNS Communications:
- * Domains:
- * Network Communication - ICMP:
- * Network Communication - HTTP:
- * Network Communication - SMTP:
- * Network Communication - Hosts:
- "country_name": "Ukraine",
- "ip": "37.19.193.217",
- "inaddrarpa": "",
- "hostname": ""
- * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement