remcos | a75995b9708a373890abd1fd63159238

Sharing

Copy URL Twitter E-mail

General

Target
a75995b9708a373890abd1fd63159238
Size 84KB
Sample220822-p8m2csbag3
SHA256 879a2a8a7d4dd3a92ad22feb7051839b05dd4a1ff599cb71da15caab5afedbe7
MD5 a75995b9708a373890abd1fd63159238
SHA1 7c96733dcffcb01894a0f924ce10d9a69d1fd5de
SHA512 827150eae6e7d09f06d296aeaf15fa62c66b05e587b964d7c1f0e01729af8788badcc1fd1eb36f9a73534c00022451957748afe44613d9905e0a5941987c1955
SSDEEP 1536:apNEsaeiQl8TIqytzRJl+uiNuI7FFCPBsZcOzq1T35T/4dLeILtVo8V:apNEaiQl2qouiNdFFCiZcOz+TJ/+eAt
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remotehost remcos

Malware Config

Extracted

Family

remcos

Version

2.2.0 Light

Botnet

RemoteHost

192.168.1.4:2404

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
3
copy_file
remcos.exe
copy_folder
remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-YI5AV2
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos family
remcos

File Explorer

a75995b9708a373890abd1fd63159238

.exe 84KB

a75995b9708a373890abd1fd63159238

IMPHASH f79bdf7005a27b505da0a17f8329bd86
SHA256 879a2a8a7d4dd3a92ad22feb7051839b05dd4a1ff599cb71da15caab5afedbe7
MD5 a75995b9708a373890abd1fd63159238
SHA1 7c96733dcffcb01894a0f924ce10d9a69d1fd5de
SHA512 827150eae6e7d09f06d296aeaf15fa62c66b05e587b964d7c1f0e01729af8788badcc1fd1eb36f9a73534c00022451957748afe44613d9905e0a5941987c1955
SSDEEP 1536:apNEsaeiQl8TIqytzRJl+uiNuI7FFCPBsZcOzq1T35T/4dLeILtVo8V:apNEaiQl2qouiNdFFCiZcOz+TJ/+eAt
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

50436

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

FindResourceA GetLocaleInfoA Process32NextW Process32FirstW CreateToolhelp32Snapshot GetTickCount GlobalUnlock GlobalLock GlobalAlloc GetCurrentProcessId GetCurrentProcess DeleteFileA LoadResource LocalAlloc OpenProcess DuplicateHandle GetCurrentThread RemoveDirectoryW lstrcpynA GetModuleFileNameA ExitProcess AllocConsole GetStartupInfoA LockResource SizeofResource GetModuleHandleA CreateMutexA GetLastError GetLongPathNameW GetModuleFileNameW SetFileAttributesW LoadLibraryA GetProcAddress CreateFileMappingA MapViewOfFileEx TerminateThread FindClose ExitThread GetLogicalDriveStringsA GetFileAttributesW DeleteFileW CreateDirectoryW CreateFileW GetFileSize CreateThread SetFilePointer GetDriveTypeA lstrlenA FindFirstFileW FindNextFileW CreatePipe CreateProcessA PeekNamedPipe ReadFile WriteFile TerminateProcess SetEvent HeapCreate HeapFree Sleep GetLocalTime CreateEventA WaitForSingleObject CloseHandle GlobalFree

user32

SetForegroundWindow TrackPopupMenu CreatePopupMenu AppendMenuA RegisterClassExA CreateWindowExA SystemParametersInfoW GetForegroundWindow SendInput GetIconInfo DrawIcon EnumWindows GetCursorPos IsWindowVisible CloseWindow ShowWindow GetWindowThreadProcessId MessageBoxW ExitWindowsEx OpenClipboard EmptyClipboard SetClipboardData CloseClipboard GetClipboardData SetWindowTextW TranslateMessage GetWindowTextW DefWindowProcA DispatchMessageA GetMessageA

gdi32

GetDIBits GetObjectA StretchBlt SelectObject DeleteObject DeleteDC CreateCompatibleBitmap GetDeviceCaps CreateCompatibleDC CreateDCA

advapi32

RegCreateKeyW RegEnumKeyExA GetUserNameW ChangeServiceConfigW QueryServiceStatus ControlService OpenSCManagerW StartServiceW OpenSCManagerA EnumServicesStatusW OpenServiceW RegDeleteKeyA RegOpenKeyExA RegCloseKey RegQueryValueExA RegQueryValueExW RegOpenKeyExW RegSetValueExA RegCreateKeyA RegSetValueExW RegDeleteValueW RegEnumValueW RegEnumKeyExW RegQueryInfoKeyW RegCreateKeyExW AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken CloseServiceHandle QueryServiceConfigW

shell32

ExtractIconA Shell_NotifyIconA ShellExecuteExA ShellExecuteW

msvcrt

_controlfp _except_handler3 __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _acmdln _XcptFilter _exit ??1type_info@@UAE@XZ _onexit __dllonexit freopen wcscat _itow _wsystem sprintf wcscpy wcslen _wgetenv exit __CxxFrameHandler tolower wcscmp atoi _wrename ??2@YAPAXI@Z getenv ??3@YAXPAX@Z _CxxThrowException ??0exception@@QAE@ABV0@@Z printf strncmp malloc free _iob _itoa

msvcp60

??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGIABV?$allocator@G@1@@Z ??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z ??_D?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ ?close@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ ??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z ??0?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAE@PBDH@Z ?find_last_of@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGI@Z ?find_last_of@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIGI@Z ??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z ?is_open@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QBE_NXZ ??0Init@ios_base@std@@QAE@XZ ??1Init@ios_base@std@@QAE@XZ ??0_Winit@std@@QAE@XZ ??1_Winit@std@@QAE@XZ ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@IDABV?$allocator@D@1@@Z ?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ ?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@IGABV?$allocator@G@1@@Z ?begin@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ ?end@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ ?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEPADXZ ?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z ?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXID@Z ?empty@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE_NXZ ??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBGABV10@@Z ??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z ??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV?$allocator@G@1@@Z ?begin@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ ?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIABV12@I@Z ?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z ?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z ?length@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ ?substr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE?AV12@II@Z ?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB ?rfind@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIGI@Z ?resize@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXI@Z ??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@G@Z ??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z ??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@0@Z ??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@PBG@Z ??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@G@Z ??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z ??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@D@Z ?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ??9std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z ??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z ??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z ??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z ??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@IIABV?$allocator@D@1@@Z ??0out_of_range@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z ??1out_of_range@std@@UAE@XZ ??0out_of_range@std@@QAE@ABV01@@Z ??0logic_error@std@@QAE@ABV01@@Z ?end@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ ?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ ??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z ??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z ??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z ?empty@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE_NXZ ??9std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z ?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ ?data@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ ?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ ?length@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB ?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDIABV?$allocator@D@1@@Z ??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z ??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z

shlwapi

StrToIntA

ws2_32

htons socket send recv closesocket connect gethostbyname WSAStartup

urlmon

URLDownloadToFileW

gdiplus

GdipLoadImageFromStream GdipFree GdipDisposeImage GdipCloneImage GdipAlloc GdipSaveImageToStream GdiplusStartup GdipGetImageEncoders GdipGetImageEncodersSize GdipLoadImageFromStreamICM

wininet

InternetReadFile InternetOpenUrlA InternetOpenA InternetCloseHandle