remcos

General

Target

73c5b71d2923b11a8b262321c6229520c93115f82c78d742f041a650725d482f.rtf
Size

63KB
Sample

240331-bhhgasba3t
MD5

b5b2948d407676eab86b1152e7ce5ec4
SHA1

85de7e562d97c36b9318393fd6185df6b1ba55b9
SHA256

73c5b71d2923b11a8b262321c6229520c93115f82c78d742f041a650725d482f
SHA512

b2048e775bccc0f0cc144fcfaa4e3067fa4ed2613f1e152323673c6497a82815d2ef366d29289214cf5f0007a3c8537af6f40b6ab07a1a936ed4f4612be9725a
SSDEEP

1536:fgoIW1uYod+RuUl9Zh7teyDdvqMhRSiupwk8uXjlh17AY9j:otyuYod+RuAZh84vSiowk8uXjlh17AYR

Score

10^/10

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

107.172.31.178:2404

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-NVSJ5U
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Targets

- Target
  
  73c5b71d2923b11a8b262321c6229520c93115f82c78d742f041a650725d482f.rtf
- Size
  
  63KB
- MD5
  
  b5b2948d407676eab86b1152e7ce5ec4
- SHA1
  
  85de7e562d97c36b9318393fd6185df6b1ba55b9
- SHA256
  
  73c5b71d2923b11a8b262321c6229520c93115f82c78d742f041a650725d482f
- SHA512
  
  b2048e775bccc0f0cc144fcfaa4e3067fa4ed2613f1e152323673c6497a82815d2ef366d29289214cf5f0007a3c8537af6f40b6ab07a1a936ed4f4612be9725a
- SSDEEP
  
  1536:fgoIW1uYod+RuUl9Zh7teyDdvqMhRSiupwk8uXjlh17AY9j:otyuYod+RuAZh84vSiowk8uXjlh17AYR
Score

10^/10

remcos remotehost collection persistence rat spyware stealer
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
- Detects executables built or packed with MPress PE compressor
- Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
- Detects executables referencing many email and collaboration clients. Observed in information stealers
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Nirsoft
- Blocklisted process makes network request
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook accounts
  collection
- Adds Run key to start application
  persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2