remcos

General

Target
14052024_0346_W2_1040_drivers license.zip
Size 19.4MB
Sample240514-ecfbjaaa98
SHA256 f2993afe3bd724db151713c80ff4e2207e66f0ef4dacfa099f516573db2a9d62
MD5 0071df8d4ca79e07ef723c9863dedf24
SHA1 36bab18af9688f1f890a876699b389f8b7a6881e
SHA512 37c21cdc3f956807ff95e8270dde94a770dafecb7dc9f3ec878aa4bbaaf983d311715d47a8ed8c77180e1284a4dc1dfc71cd9d2b533e60927af5cfb8e2529a5e
SSDEEP 393216:A7ygRDRORvrRF2TgFZKL+Ue18+uzqwLpgXQQs7HEO9NWX1TG:eyMOTugFQ+UT+REpcNs7HEOzO5G
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

faststaynow.duckdns.org:5057

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-0TC926
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Targets

- Target
  W2_1040_drivers license/2023 Tax Organizer.exe
- Size 5.5MB
- SHA256 a046e2108d61775633c225a45a4801f79592e7770ccb4aaf4da51882254d3fca
- MD5 bc79e91265ac5cd74de7c35f0a7fd20c
- SHA1 1d0d225846f571654afbf81937b728033211bf11
- SHA512 4fc649e071870af00b3a8e36eb086f84f30cd162283e86286d5c0e52d5123cd581c72196a83010addba276fedcb59a3c851ac71483376e3eb10b1110898e6907
- SSDEEP 98304:7MrZJgVmlhdyvWZCEirUMrvQrxe5zS31AGEDzwT4:jgUvzLoMrYdIDEc
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

remcos remotehost persistence rat
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Adds Run key to start application
  persistence
- Suspicious use of NtCreateThreadExHideFromDebugger
behavioral1 behavioral2
- Target
  W2_1040_drivers license/msimg32.dll
- Size 45.1MB
- SHA256 1a9afb8a9e6075253a88f6ddc5ffb989a372d1fa9687052f17f68c4d1d094247
- MD5 55aaccd6514b5c7be26837c62b37549c
- SHA1 e486114ecdf933f0cbb1851d9cce83c6183ab6f0
- SHA512 3e43bafcb51d4e64eebd61d8f27bae8aed85df99ab79ea65f4d165a2d4dba59b404f7cf3f96550f0855ea076c88c6dd87af71c4421c77b5dc526ed5cfc0c88f0
- SSDEEP 786432:NUP7GCGO7t0Srkx/tC0SzIdSwh/WxbpNHQD3trzRpR:NUP7GCG6iSrkx1hSzYsHQD3t/Rv
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

remcos remotehost persistence rat
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Adds Run key to start application
  persistence
- Suspicious use of NtCreateThreadExHideFromDebugger
behavioral3 behavioral4