remcos

General

Target

408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c.exe
Size

996KB
Sample

240409-bqgjzahg54
MD5

0f590a7d7c99e395fa9aaa1159e00fb3
SHA1

58322ce759d00892e146a499456492f19b03ede0
SHA256

408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c
SHA512

27c402a22a4cc414a53584a55a87e6d314c62f8958ee8ee690020aaa762c1aede794877cdc37806c9f1c3aa6d9dd5e675e10bc9efcf567987f86cf1ede4e1c59
SSDEEP

24576:Ko5SLBTIjiK1MweZsLuI2/OFea6hPj42nqxvS:z5StsR1MwiOFGctxv

Score

10^/10

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

paygateme.net:2286

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-WTDTSU
screenshot_crypt
true
screenshot_flag
true
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
1
take_screenshot_option
false
take_screenshot_time
5

Targets

- Target
  
  408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c.exe
- Size
  
  996KB
- MD5
  
  0f590a7d7c99e395fa9aaa1159e00fb3
- SHA1
  
  58322ce759d00892e146a499456492f19b03ede0
- SHA256
  
  408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c
- SHA512
  
  27c402a22a4cc414a53584a55a87e6d314c62f8958ee8ee690020aaa762c1aede794877cdc37806c9f1c3aa6d9dd5e675e10bc9efcf567987f86cf1ede4e1c59
- SSDEEP
  
  24576:Ko5SLBTIjiK1MweZsLuI2/OFea6hPj42nqxvS:z5StsR1MwiOFGctxv
Score

10^/10

remcos remotehost collection rat spyware stealer
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
- Detects executables built or packed with MPress PE compressor
- Detects executables packed with SmartAssembly
- Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
- Detects executables referencing many email and collaboration clients. Observed in information stealers
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Nirsoft
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook accounts
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2