remcos

General

Target

16461695585.zip
Size

113.8MB
Sample

240412-cedjlsca42
MD5

5ec721b44ba7b7951f6ecabed84ae540
SHA1

c58e74ac47166bd93be51883d5062d75504978cc
SHA256

6a5b162209ae004d9f3406fe9a6efff71388bdb2b40b377b168c17cd7e967fef
SHA512

266b49353be111267df56886132945d7df2f829a1b4d1ceeb17062d031094f4a2b6b0af177ec4bb66ee5c11941ba1d3ddd32072246b9dfb62afcf4925447747c
SSDEEP

1572864:Ggil7aO8NDnY+eAyW7PQfIUME2vCICvGVwDJr4gNzCccH6GuPh1IAyb1D5kRGbZF:W8NDMAN7PQfIA2vC44Jr4Pa7p+bIu

Score

10^/10

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

ogbatobanana.duckdns.org:4047

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-TANRSC
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Targets

- Target
  
  1099Misc.inf
- Size
  
  130.0MB
- MD5
  
  f158d3387c6e2cb1b482f7b7abee7e20
- SHA1
  
  9aadedb8049339dd027a45bc733caa1f6f3dc7a9
- SHA256
  
  c052369f476b624913e8aec1a3ba729d30b5d5f145c4c5c58d64f7d09cfa54b5
- SHA512
  
  93e92533c93d966007eaf6fb35772e362326eb8bd321f1db28cfa98943277589a393081157a8832f162776127eb91974e3f93a2ea3475e936db1f228973bc40e
- SSDEEP
  
  3145728:96lH+byk0ZggBznCh2HCea5bQ92NmDVr9XqnZGWp:
Score

1^/10
behavioral1 behavioral2
- Target
  
  TAX Organizer.exe
- Size
  
  31KB
- MD5
  
  3e71ed46603b02a94b921411a19b7a5c
- SHA1
  
  b1374ef6717635d07015d8acb700cf95b2a66b12
- SHA256
  
  1131f33552a12921f6f4d7d9e503feae4b12c367d5377e226acf270f6b58ca6e
- SHA512
  
  28555a8bf20e4f8d42b21685c06e429bc5261f75e9fb65b970a322907d7da4a4ee7d367f4637ea4abb6ef32fae8e71a9d92b4f253a201e94548d68281edccbaf
- SSDEEP
  
  384:e8Kj/M8yEryzqEt7a9Oey+IFdP64VYaEwDtiBgxoxlnLr2STcEICxXBhgBx4eMDa:eDD1r+VWOV+csoHViBBn+EFIqeMDGvaS
Score

10^/10

remcos remotehost persistence rat
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Adds Run key to start application
  persistence
- Suspicious use of NtCreateThreadExHideFromDebugger
behavioral3 behavioral4
- Target
  
  g2m.dll
- Size
  
  150.0MB
- MD5
  
  168e67b8f74c2663d8471522e5518e7d
- SHA1
  
  853812d60315476b7764fb3907473554ab1fa2c0
- SHA256
  
  c33ad20287bf2b59a570c901f538c4dc8bcd164a502fd400683b1835325c97b5
- SHA512
  
  24b4bd90d7e0daebb52ed24bd1642363a31c3340749a22b677ebc01d8ca824305344578747ee08f6c0ad225945ca83bc6754e880741efef7520ae604188e3373
- SSDEEP
  
  786432:FUP7GCGO7b0Srkx/tC0SzIdSwh/WxbpNHQD3trzRp:FUP7GCG64Srkx1hSzYsHQD3t/R
Score

10^/10

remcos remotehost persistence rat
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Adds Run key to start application
  persistence
- Suspicious use of NtCreateThreadExHideFromDebugger
behavioral5 behavioral6