remcos

General

Target
03052024_0423_Estimated 2023 tax Docs.zip
Size 11.1MB
Sample240503-ezyfmaeh9t
SHA256 1a68aca62e00ff2d44bf9b5bab0840043dee5342ded8bdbbcae372d4c9f2db8b
MD5 2aa6a1831f7a94e8dba3c53d1ce90e60
SHA1 90cf44533b515c0978cdb3343812bdf7f4be8e14
SHA512 93a0e335d7421677e90e95e4f5abf3f03fdccb4eaae93d2891860c66d4c6d45b476b4d87f392bb4ddbe9df5a6321ba9574e60ee030d9f368ef905dc0b9ee0a9c
SSDEEP 196608:V7hf9NTXeg89a5XFKclJ6B9OHQu4jEHXThg/8b1qDSdac+zPr1eMnIKFRG:V7hf9FXx89WXkcf6n+Qu4jEHXmE1KScw
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

quickdatenight.duckdns.org:4047

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-JCJG7N
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Targets

- Target
  Tax Organizer.exe
- Size 31KB
- SHA256 a73709c1b5f1f875ee35f477c4e263a57050c36e2cff31ad1ceca17d9623e7cd
- MD5 4db45c5fdb9e115b922bdf007523f082
- SHA1 90297382a170ff3ea7931db2425329d0b2f70f04
- SHA512 7f0bcb2ee96c523cce764d1ec7d197d3aadddcf6fae71b63e88c3a26883b2f2fb4a446187adfbb023be779056ebc0ea50a785c72bbe97bb7dca41a810d0ff6c7
- SSDEEP 384:V4Kj/M8y6ryzqEt7a9Oey+IFdP64VYaEwDtiBgxoxlnLr2STchsCxXBhgBx4eMDg:VHDXr+VWOV+csoHViBBn+hRIqeMDGt
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

remcos remotehost persistence rat
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Adds Run key to start application
  persistence
- Suspicious use of NtCreateThreadExHideFromDebugger
behavioral1 behavioral2
- Target
  g2m.dll
- Size 27.9MB
- SHA256 3f8ceeb3547fb075ec11efbb848a21c63374f42d6955834077e5cba1667e4620
- MD5 df700e4ebb6bddeb3abb281657044133
- SHA1 419c1232247c3aaabf22a8a31e0b0a48bef1d369
- SHA512 09209d42b5df350465959c51ec7319d2d227cf0c910a273d9545e5bbed3a1e50b86d1a2622d4ef2a26ca1ef23c5520d89a8d48ec70fcd6908d207d6ca7953135
- SSDEEP 393216:pezzU7EDJ63vIMxrsjnh7CHfqkALvIzhJRYiE/XWKNnBcRpO:YznCvRGwCXUhJRYiE+0nBcRI
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

remcos remotehost persistence rat
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Adds Run key to start application
  persistence
- Suspicious use of NtCreateThreadExHideFromDebugger
behavioral3 behavioral4