remcos

General

Target
11052024_0208_TAX ORGANIZER 2023_stripped.zip
Size 11.3MB
Sample240511-clep9aaa95
SHA256 9edb362c45d38d223d521d49aed8014917d81a7771026616243c1fa4ab409d1d
MD5 b07047a62a593388fb9ac1737aa1dd1b
SHA1 88208fa286f5d1a9160643f06c7fe2e7dd38f1d6
SHA512 6d989bfec1caf90946ea1f9161cf4e1ea52f2986d7ff2a02d61ecc8598e12f166cad4c9ef3ab4137396d53eb36e5649ce29a86a05b623314cf7300b264193245
SSDEEP 196608:zMdOlFzVl2oyrg/+uF62ouh6zvfOvb3r26HGCd+4du07EvzVO/eTHBsAdYk3:V5hFI2o+jb3r2vCd+4du07KVgeTHGAd5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

faststaynow.duckdns.org:5057

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-C1BRX3
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Targets

- Target
  TAX ORGANIZER 2023/Sandra 2023 Tax Organizer.exe
- Size 31KB
- SHA256 a73709c1b5f1f875ee35f477c4e263a57050c36e2cff31ad1ceca17d9623e7cd
- MD5 4db45c5fdb9e115b922bdf007523f082
- SHA1 90297382a170ff3ea7931db2425329d0b2f70f04
- SHA512 7f0bcb2ee96c523cce764d1ec7d197d3aadddcf6fae71b63e88c3a26883b2f2fb4a446187adfbb023be779056ebc0ea50a785c72bbe97bb7dca41a810d0ff6c7
- SSDEEP 384:V4Kj/M8y6ryzqEt7a9Oey+IFdP64VYaEwDtiBgxoxlnLr2STchsCxXBhgBx4eMDg:VHDXr+VWOV+csoHViBBn+hRIqeMDGt
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

remcos remotehost execution persistence rat
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Blocklisted process makes network request
- Adds Run key to start application
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Suspicious use of NtCreateThreadExHideFromDebugger
behavioral1 behavioral2
- Target
  TAX ORGANIZER 2023/g2m.dll
- Size 27.9MB
- SHA256 d7350580234b4ec776d869758ffab607f2ff42efe3a938b140ad182417cd4e29
- MD5 0a2c9acac48e85f0be788220ff712a3e
- SHA1 2e1fbba29f518b8e98bc4bb0dfc3ef1c6d8f2261
- SHA512 9fbb5242355feb5b0cf1c4f00ae0fe0646aba1d11338fe078b3e37defda0e1b164b19a02a14568bc7d7bf2716b4a38dbc16da744230c01550b2642d50df4b298
- SSDEEP 393216:lezzyEDJ63vIMxrsjnh7CHfqkALvIzhJRYiE/XWKNnBcRlp:8zHCvRGwCXUhJRYiE+0nBcRT
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

remcos remotehost execution persistence rat
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Blocklisted process makes network request
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application
  persistence
- Suspicious use of NtCreateThreadExHideFromDebugger
behavioral3 behavioral4