remcos

General

Target
459120568.zip
Size 874KB
Sample240224-3n27fagg75
SHA256 0fc6ed0c9e43593b88d61614e3b17877cf361599862b0659152f4c7cc00fc797
MD5 aa330af924e28f830f056e63fc8409e6
SHA1 164461f63c94d5652bd1a56bb51fe256f902529e
SHA512 d080e09f03f184bb54aa0d50ee9fef03d90efb699f21e36942aa6884a98898284eac5194aa060587f61c97a1769a6bef4d0750dae152252f5d93f15f9b7d1951
SSDEEP 12288:EfAN2COO6pe6sYI7NlGAgw/+KSWYZ3xCLk91cIBamKerQ1AWA0YGQXNGsO:EfANLz8e6slpg3ELkLcKQ19A0XUgsO
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

remcos

Botnet

iruka

C2

91.223.3.151:4508

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-TG1HDZ
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Targets

- Target
  459120568.zip
- Size 874KB
- SHA256 0fc6ed0c9e43593b88d61614e3b17877cf361599862b0659152f4c7cc00fc797
- MD5 aa330af924e28f830f056e63fc8409e6
- SHA1 164461f63c94d5652bd1a56bb51fe256f902529e
- SHA512 d080e09f03f184bb54aa0d50ee9fef03d90efb699f21e36942aa6884a98898284eac5194aa060587f61c97a1769a6bef4d0750dae152252f5d93f15f9b7d1951
- SSDEEP 12288:EfAN2COO6pe6sYI7NlGAgw/+KSWYZ3xCLk91cIBamKerQ1AWA0YGQXNGsO:EfANLz8e6slpg3ELkLcKQ19A0XUgsO
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral1
- Target
  459120568.exe
- Size 1020KB
- SHA256 53c00aee40c92375daef04e2cb894f532c3c0eac1d8d53f0315c8d981ba3c883
- MD5 421be0c5e144b6f0945b421839ce8841
- SHA1 8ff552d574e4f581cd776c6c58fd0f735be4a085
- SHA512 0f5d1a4d940a42338bfbaa212bb50507b691044987605821d996ab1a6c8217325bce73aa61a95cd40e24f82c2ed4b0c898a3ea4ef476779c5fe77a8f0950821d
- SSDEEP 24576:EiUmSB/o5d1ubcvhjLtp8L1FrPIAyvkJK4wQtmD4y:E/mU/ohubcvhjm11POvixj
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

remcos iruka collection rat spyware stealer upx
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Nirsoft
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Accesses Microsoft Outlook accounts
  collection
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Suspicious use of SetThreadContext
behavioral2
- Target
  out.upx
- Size 1.5MB
- SHA256 6190ac5799558b790f98789d2a455e0ef4fe054e18093468c4bda8def5bf4e9d
- MD5 bbb31ed9752e8b2cd83df98b0d480930
- SHA1 2250c8b321ad3cb3a09c351764101443fcf551b7
- SHA512 9d939f127278c6d29f454ba3a9807455c8930d14c97f084c1369960ace821e380d9875c95dc2dc6d97503f08b214451093fc7d5d73cfc2802580d259c4c84f14
- SSDEEP 24576:8qDEvCTbMWu7rQYlBQcBiT6rp3djtp8L1FrPIAyvkJK4wQtmD4y:8TvC/MTQYxsW5c11POvixj
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral3