remcos

General

Target

Screenshot 2022-12-16 08.35.47.png
Size

124KB
Sample

230111-nsh7ssfg8z
MD5

482c8430c5604dafffe98760447eac1e
SHA1

320d01845efffa73c3a11ae2548b60126e437fce
SHA256

58c9c936416069e0afcef595283a78505524751a63f2db0265851b669404cb9f
SHA512

b3152fd3233c9b856fb6482d1d24e69d6705cc72941f24683041ac716c659cdb1c611e272242ab1742ea715312f3e31d4e2384454159427d1425ab263d1ddbe5
SSDEEP

3072:aK7TdQPpw7xddddGYwRjARfMSlbmQrVSyIbd+FKwPPg:L7jwl4SQUvRDwHg

Score

10^/10

Malware Config

Extracted

Family

remcos

Version

1.7 Pro

Botnet

Host

C2

nickman12-46565.portmap.io:46565

nickman12-46565.portmap.io:1735

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
5
copy_file
Userdata.exe
copy_folder
Userdata
delete_file
true
hide_file
true
hide_keylog_file
true
install_flag
true
install_path
%WinDir%\System32
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%WinDir%\System32
mouse_option
false
mutex
remcos_vcexssuhap
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screens
screenshot_path
%AppData%
screenshot_time
1
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5

Extracted

Family

revengerat

Botnet

Guest

C2

0.tcp.ngrok.io:19521

Mutex

RV_MUTEX

Extracted

Family

warzonerat

C2

168.61.222.215:5400

Targets

- Target
  
  Screenshot 2022-12-16 08.35.47.png
- Size
  
  124KB
- MD5
  
  482c8430c5604dafffe98760447eac1e
- SHA1
  
  320d01845efffa73c3a11ae2548b60126e437fce
- SHA256
  
  58c9c936416069e0afcef595283a78505524751a63f2db0265851b669404cb9f
- SHA512
  
  b3152fd3233c9b856fb6482d1d24e69d6705cc72941f24683041ac716c659cdb1c611e272242ab1742ea715312f3e31d4e2384454159427d1425ab263d1ddbe5
- SSDEEP
  
  3072:aK7TdQPpw7xddddGYwRjARfMSlbmQrVSyIbd+FKwPPg:L7jwl4SQUvRDwHg
Score

10^/10

remcos revengerat warzonerat guest host evasion infostealer persistence rat rezer0 stealer trojan upx ransomware
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- RevengeRAT
  Remote-access trojan with a wide range of capabilities.
  trojan revengerat
- UAC bypass
  evasion trojan
- WarzoneRat, AveMaria
  WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
  rat infostealer warzonerat
- Modifies boot configuration data using bcdedit
  ransomware evasion
- ReZer0 packer
  Detects ReZer0, a packer with multiple versions used in various campaigns.
  rezer0
- RevengeRat Executable
  stealer
- Warzone RAT payload
  rat
- Drops file in Drivers directory
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Drops startup file
- Loads dropped DLL
- Uses the VBS compiler for execution
- Adds Run key to start application
  persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2