remcos | 74948fcfeb4232ecaee315a1e75b9756

Sharing

Copy URL Twitter E-mail

General

Target
74948fcfeb4232ecaee315a1e75b9756
Size 100KB
Sample220724-e81bksfcg5
SHA256 d68a8086daa22485827f74140e91325a1c751329c29f23f61c7c33856705b151
MD5 74948fcfeb4232ecaee315a1e75b9756
SHA1 13a35894d0c32cbc4ceca199d383ba4b2486a6ad
SHA512 a8012f9b4789d9062002712c4c571a00a43a906e1f5fc6b13c1ea853c42fb1fc2edd13fb64e11c2ac37cfc6b8e9715dab0e0179f43ec5d6215247009f437ea4d
SSDEEP 3072:vhzYTGWVvJ8f2v1TbPzuMsIFSHNThy+JP/P6nrs:vhzOv2fM13jsIFSHNT7P/P6rs
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

president remcos

Malware Config

Extracted

Family

remcos

Version

1.7 Pro

Botnet

President

winam.ddns.net:2404
runam.ddns.net:2404
windda.ddns.net:2404
widda1.ddns.net:2404

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
180
copy_file
svchost.exe
copy_folder
updates
delete_file
true
hide_file
true
hide_keylog_file
false
install_flag
true
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
windows
keylog_path
%AppData%
mouse_option
false
mutex
remcos_nsttxbncgz
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screens
screenshot_path
%AppData%
screenshot_time
1
startup_value
Logs
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title

Signatures

Remcos family
remcos

File Explorer

74948fcfeb4232ecaee315a1e75b9756

.exe 100KB

74948fcfeb4232ecaee315a1e75b9756

IMPHASH d3a62971944197f0701c7049a9c739d1
SHA256 d68a8086daa22485827f74140e91325a1c751329c29f23f61c7c33856705b151
MD5 74948fcfeb4232ecaee315a1e75b9756
SHA1 13a35894d0c32cbc4ceca199d383ba4b2486a6ad
SHA512 a8012f9b4789d9062002712c4c571a00a43a906e1f5fc6b13c1ea853c42fb1fc2edd13fb64e11c2ac37cfc6b8e9715dab0e0179f43ec5d6215247009f437ea4d
SSDEEP 3072:vhzYTGWVvJ8f2v1TbPzuMsIFSHNThy+JP/P6nrs:vhzOv2fM13jsIFSHNT7P/P6rs
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

64904

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetModuleFileNameA GetLongPathNameA CreateMutexA OpenMutexA Process32Next Process32First CreateToolhelp32Snapshot SizeofResource LockResource LoadResource FindResourceA GetLocaleInfoA Process32NextW Process32FirstW lstrlenA GetDriveTypeA CreateProcessA GetTickCount GlobalUnlock GlobalLock GlobalAlloc WinExec GetCurrentProcessId CreateDirectoryW CopyFileA GetFileAttributesW GetLogicalDriveStringsA GetCurrentProcess ResumeThread SetThreadContext WriteProcessMemory VirtualAllocEx ReadProcessMemory GetThreadContext VirtualAlloc GlobalFree LocalAlloc TerminateProcess ReadFile PeekNamedPipe GetStdHandle CreatePipe OpenProcess DuplicateHandle GetCurrentThread lstrcpynA ExitProcess AllocConsole GetStartupInfoA ExpandEnvironmentStringsA FindFirstFileA FindNextFileA GetLastError LoadLibraryA GetProcAddress CreateFileMappingA MapViewOfFileEx DeleteFileA RemoveDirectoryA CloseHandle GetFileAttributesA SetFileAttributesA SetEvent TerminateThread FindFirstFileW FindNextFileW FindClose GetLocalTime CreateEventA WaitForSingleObject CreateDirectoryA ExitThread Sleep GetModuleHandleA DeleteFileW CreateThread

user32

GetWindowTextLengthA GetForegroundWindow UnhookWindowsHookEx CloseClipboard GetClipboardData OpenClipboard SetClipboardData EmptyClipboard ExitWindowsEx MessageBoxA GetKeyboardLayoutNameA GetWindowThreadProcessId ShowWindow CloseWindow GetWindowTextA GetWindowTextW EnumWindows SendInput CreateWindowExA RegisterClassExA AppendMenuA CreatePopupMenu TrackPopupMenu SetForegroundWindow GetCursorPos DefWindowProcA GetKeyState CallNextHookEx SetWindowsHookExA GetMessageA TranslateMessage GetKeyboardLayout FindWindowA DispatchMessageA IsWindowVisible

gdi32

CreateDCA CreateCompatibleDC GetDeviceCaps CreateCompatibleBitmap SelectObject StretchBlt GetObjectA GetDIBits DeleteObject DeleteDC

advapi32

OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegCreateKeyExA RegQueryInfoKeyA RegEnumKeyExA RegEnumValueA RegDeleteValueA RegCreateKeyA RegSetValueExA RegOpenKeyExA RegDeleteKeyA RegCloseKey RegQueryValueExA GetUserNameW

shell32

ShellExecuteA ExtractIconA Shell_NotifyIconA ShellExecuteExA ShellExecuteW

msvcp60

?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEPADXZ ?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEPADXZ ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@@Z ?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IIPBD@Z ??8std@@YA_NPBDABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z ??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z ??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV?$allocator@G@1@@Z ?find_last_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z ??9std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z ??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@G@Z ?substr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE?AV12@II@Z ?rfind@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIGI@Z ?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB ?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z ??0Init@ios_base@std@@QAE@XZ ??1Init@ios_base@std@@QAE@XZ ??0_Winit@std@@QAE@XZ ??1_Winit@std@@QAE@XZ ?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z ?find_last_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z ??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBGABV10@@Z ??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z ??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@DABV10@@Z ?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z ?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z ?begin@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ ?end@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ ?length@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ ??Bios_base@std@@QBEPAXXZ ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z ?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@IDABV?$allocator@D@1@@Z ??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z ??0?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAE@PBDH@Z ?is_open@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QBE_NXZ ?data@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ ??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z ??0logic_error@std@@QAE@ABV01@@Z ??0out_of_range@std@@QAE@ABV01@@Z ??1out_of_range@std@@UAE@XZ ??0out_of_range@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ ?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z ??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z ??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z ??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDIABV?$allocator@D@1@@Z ??_D?$basic_fstream@DU?$char_traits@D@std@@@std@@QAEXXZ ?close@?$basic_fstream@DU?$char_traits@D@std@@@std@@QAEXXZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBDH@Z ?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@JW4seekdir@ios_base@2@@Z ??0?$basic_fstream@DU?$char_traits@D@std@@@std@@QAE@PBDH@Z ??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z ??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@D@Z ?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ ??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z ?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB ?length@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ ??9std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z ?empty@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE_NXZ ??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z ?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIABV12@I@Z ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z ??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@0@Z ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z ??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ ?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ ??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@PBG@Z ?end@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ ?begin@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ ??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@G@Z ??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z ??_D?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ ?close@?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PADH@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@JW4seekdir@ios_base@2@@Z ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@H@2@XZ ?is_open@?$basic_ifstream@DU?$char_traits@D@std@@@std@@QBE_NXZ ??0?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAE@PBDH@Z ??_D?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ ?close@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ ??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z

msvcrt

_wrename _controlfp __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _acmdln _XcptFilter _exit _onexit __dllonexit ??1type_info@@UAE@XZ _iob freopen srand rand mbstowcs realloc _itoa sprintf getenv toupper tolower wcscmp printf strncmp malloc free _EH_prolog __CxxFrameHandler time localtime strftime puts atoi _ftol ??2@YAPAXI@Z _except_handler3 exit ??0exception@@QAE@ABV0@@Z _CxxThrowException

winmm

waveInOpen waveInStop waveInClose waveInAddBuffer waveInPrepareHeader waveInUnprepareHeader waveInStart

shlwapi

PathFileExistsA

ws2_32

htons gethostbyname closesocket socket send WSAGetLastError connect recv WSAStartup

urlmon

URLDownloadToFileA

gdiplus

GdipLoadImageFromStreamICM GdipDisposeImage GdipCloneImage GdipAlloc GdipSaveImageToStream GdipSaveImageToFile GdipLoadImageFromStream GdiplusStartup GdipGetImageEncoders GdipFree GdipGetImageEncodersSize

wininet

InternetCloseHandle InternetOpenUrlA InternetOpenA InternetReadFile