remcos

General

Target
PAYMENT_ADVICE_MT_103.tar
Size 783KB
Sample240212-kdzz8aaf66
SHA256 5cbf2ecbf0a37fc248a41dc426aa17400f566ed73b51d26fae0ab3506bd1a6e6
MD5 6f0e28d13865a5c1b3f50d521aa2ceeb
SHA1 4a6cc25d47a8968eca2e3489e51d5526bc9b524d
SHA512 0daebec5deb18722f4dd777d116cacbc8f820d0f6e466cb0b715c434d4a4f622bef13525b6328594f92919ed5674cb275b6b75ef2ac78b830ee7125d07c59036
SSDEEP 12288:/0EAV7W+Qv1cttRaIRKwtLos2BjO/hSZuHq4nAx:/0Rs+Qv1cttwIFLos2BjO/heul
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

172.96.14.30:6871

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-KNH112
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Targets

- Target
  PAYMENT_ADVICE_MT_103.tar
- Size 783KB
- SHA256 5cbf2ecbf0a37fc248a41dc426aa17400f566ed73b51d26fae0ab3506bd1a6e6
- MD5 6f0e28d13865a5c1b3f50d521aa2ceeb
- SHA1 4a6cc25d47a8968eca2e3489e51d5526bc9b524d
- SHA512 0daebec5deb18722f4dd777d116cacbc8f820d0f6e466cb0b715c434d4a4f622bef13525b6328594f92919ed5674cb275b6b75ef2ac78b830ee7125d07c59036
- SSDEEP 12288:/0EAV7W+Qv1cttRaIRKwtLos2BjO/hSZuHq4nAx:/0Rs+Qv1cttwIFLos2BjO/heul
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2
- Target
  PAYMENT_ADVICE_MT_103.bat
- Size 781KB
- SHA256 6ebe4d76f2a687dcab1c67ad244d67115c04bc3b68f623533968eeb70703dce7
- MD5 16f182d34c6bf536bd87c8805cda647c
- SHA1 07c6ebde00c8c21d5bbdeae2a73734c07cd30ea3
- SHA512 d30cc46e02faace7cdda2f51a41d9a884fea2a2ff3154ddb77c76ced5bdaf54b38ec7b6a349baeb5241ea126b801648aacf523c0a1e4ec081b90253edefdd217
- SSDEEP 12288:c0EAV7W+Qv1cttRaIRKwtLos2BjO/hSZuHq4nAx:c0Rs+Qv1cttwIFLos2BjO/heul
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

remcos zgrat remotehost collection persistence rat spyware stealer
- Detect ZGRat V1
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Nirsoft
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook accounts
  collection
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral3 behavioral4