姭Lh�� �,M1Y*�(�$�v��l��f�r�=|�K���=�@ԍ�x4���9!�#�_����s�Oƣ_+�"ލ���\M湸����Hn����~���D�v!���|!�<F�8E�tk8�E�0<m��"��8�VIJ����݇��Ǽ�ك�4����u�21#T����;�)�YMt�.i�A��뿤K�,R�!3����Ê/�=�1[އ��nLY�����L)�yZ���WA��� ���}/�<¹ܠ�]R���*���4���P6��N�*&�W!�#�9�=�b���Z�HL��ſQ�Ww�f��T�hV��qÕ�ݏ�������I� �3ΐ�W���Xf��(��ߙ����9$�J����+~ �Di��r+�l�G��7��QD{���D��bH>}������Eȼ����-�dZ �"Y}Ua����.�D_ƣ8���Ttq\��_�Q�َzs� ��1J�N���=Z��B7���I�dqy;P��L�i�& ���������$`G�V7wϭѫ} ��;C_�/�����7���otޝg5X`j�J��p���c��Mz��#���5�����Q�v�|���ǡ��#�b�5���f��M� ���1^fE�� Q"�����j���+�n5ڔ�s�n�r��[{�Q���yR��>�K�c��o<�C�h ���ڞJ�r��4=-���$J�/�qme<�)�Y���/�QCW���O�1{�_�������*V������wKT�у@F3�v���q�m\|� a*���B�#�:~�fcE<ʧ'��j��w0-�� ��1&Rt��y F��Ҏ��?��}'���2>?9�}���Oe�t2��M���(&���;��(9���Ć�ƪw^�g�����u1B�c}��N�;�_���m�FǑj�,ߤs>U��Y|փ�C���]���p�;u��YCR|��a0�&<B�� �3(��l�^�z ]h߽tR�.zE��c'����V�HDx�ônj����պv��Al�����:u �Hi�ѩ^���FuA�>S��)�?[�2b:����B�����n3���M-_y�����0 ��-XF �@᧔�j���J,���d-�=�b��1#�R�� Wۮ�L��fgő�:��2y ; �UG�p�}���|��-=D�t0Ȗ3���A=0m�IV����S���+�k(�����*�R!���c����{Va|��6l�&u˧�2m��a����Pѝ�z�/]{魻�����0����u"��C� �1�}����]f2��T��������vB������ ��.�d��3̦(-Q��O�oz&�+����iR7:��Cx�{���S(8�z4�7Nq+EW��j��lw31�ո�a!�8X�� ���S2�u���P 39�Q��`=Ј{�<��_��;Ob��:O��3D���y̼&��~�79�j�� �t기���l��j��b��.0(h�A�uc�'vgJ������^D���� �ƍ�� _��� �݅N��D�K�%2��*,mI^�=������S� 7v�ӹ��@Ի�+~�U��>"Ro�Q9�x�˃���q�#��({1�a� �s��NfP��V��?��$�4uE&�J 4�f����3����^~x��5]օU�"�m�v%O��wQK��mot#�+��%�$Vn�y�#B $L���z���8��I$�����Q�ȾXѬO|�!!|h?o�`y�&W�-8���>�+2�}����O�ȳY:�gm�"����>��Q�B7g��u:�����9�nF$�L��g�l͜�|i���S ��ן�UETy��*�ɗ��DR�Q��Q�t��P!qJ{�c���8Jhi�y�k�y|�5m$ՇF����B���<3������ '�&H˧8m\Q����#-Z�C��И��?W�T�<İgw�����akބ�q#�Μ� ��b��%<�H2_�e���Z%ʑ��.��k~Iaܯv�&��~x��1>�>�'@|��Ɗs�jbb���n�A�����Ѧ�@���Ԣ<~�X�Z,��L 6۱�4! ~%^�8����͆Gײ��L��" �Df�����$oƣ��?�f����P.�Š���BrW��Q��� $�<:��e�?�j�81�� 9Ԋ�K1��.)5,�4�\Ky�돆B�L�w�X @:ʵ)S�Ҟ�m�}�=A��{.?�(�yRR���>�|9��7��q���C�&�}pz�o��>k��H�e��%h���Y���W ں:ŋ-B��F0�D!�c28���������Ez.٦'(��3��#�f����P��k��0��.�x��/2�5���G˫�z������H�T#�� ֞܈,��5����e��dѢ Q��?�������<��X �j#� Z�LQ\�Iy���@Ď���V��C">2kd���Pb��^�� �CQz�����çAl�Q�j������{]�S��>���PJ?o�'q&��i���q b$#��tB��e�CMP>�,�B��&�e��~�vz�'��l{���D)���H8SJN�^���/0Y����i���Z�.�*'L�&�����3r�jM��ܗ�2����"�6�����9��������>b��TnɳZd���L�����Y�<��\�XG~�c$#�v%[5����l�6�c��L]%��I����'{�ʔ.Ȣ�{��4�J:,|%�hx�,�+���3!��m�bk��@EL��hyZ�@���B5"�� �s�Wjܺ�ݰe�_�`���(�_��TZ����`9g��������+뼧ؕ����7�:�o�]�=�r�v���VZ�X�Fwv(����+{���7s���V�V��D������W�����N�1���~��p�W��#n�U�dq#5�; ���e�����p����es�ŀ��0�DM���kL1g4�j��2�&���dl~Iq[���k��4֏�ܴ��Y��}��Ֆz��B(��uZ���˚��1�. n"���9��?)�D��M@�B�;l���>�Q�
General
-
Target
pass 777 REMCOS v1.7 Professional.7z
-
Size
12.0MB
-
MD5
693b32731934f4f42946e5e1be1efd0f
-
SHA1
44e5a39f928e8119debb3763fbaa9200862e961e
-
SHA256
5816ffad0307e947580e8b61bc3b7a3feedd945f00b7ccfae56ba8564832c57a
-
SHA512
a797fbb5b6114cf9d303ec63bac0a4576934fa50d874331a2091c7d306d3f77f8b2af3412ef76121133b83b0623f106ed46cd56cb597c991b6ca26c822c3c9cb
-
SSDEEP
196608:L9tYskxWGqOHlFLE8Ef+fBFIT7As2qgrQiWyLWaVwOUZzDFfCnwUapgqnwrk0:ptYs0WGqO/Q8dfBFSkzTUiWyxmZv1gaY
Malware Config
Signatures
-
resource yara_rule static1/unpack001/REMCOS v1.7 Professional/Remcos Loader.exe vmprotect -
Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/REMCOS v1.7 Professional/REMCOSAuthHooks.dll unpack001/REMCOS v1.7 Professional/Remcos Loader.exe unpack001/REMCOS v1.7 Professional/remcos.exe
Files
-
pass 777 REMCOS v1.7 Professional.7z.7z
Password: 777
-
REMCOS v1.7 Professional/REMCOSAuthHooks.dll.dll windows:5 windows x86 arch:x86
Password: 777
d452660aa6c160f2a66e1e195c1fec6c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
WriteFile
CreatePipe
FindClose
GetFileAttributesW
DuplicateHandle
MultiByteToWideChar
GetLastError
CloseHandle
GetLocalTime
SystemTimeToFileTime
CreateProcessW
WideCharToMultiByte
GetCurrentDirectoryA
lstrcatA
LoadLibraryW
CreateThread
GetProcAddress
GetModuleHandleW
GetTickCount
WriteProcessMemory
VirtualFree
GetStdHandle
WaitForSingleObject
GetVersionExW
ResumeThread
OpenProcess
CreateToolhelp32Snapshot
GetExitCodeThread
Process32NextW
LoadLibraryA
Process32FirstW
GetNativeSystemInfo
VirtualAllocEx
FreeLibrary
FlushInstructionCache
CreateRemoteThread
lstrcmpiW
DecodePointer
GetCurrentProcess
FindNextFileW
GetFullPathNameW
SetLastError
SetHandleInformation
FindFirstFileW
VirtualAlloc
ReadFile
HeapSize
WriteConsoleW
GetProcessHeap
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
GetTimeZoneInformation
GetStringTypeW
FlushFileBuffers
SetFilePointerEx
ReadConsoleW
SetEndOfFile
GetConsoleMode
GetConsoleCP
SetStdHandle
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
InterlockedExchange
HeapCreate
VirtualProtect
HeapFree
InterlockedCompareExchange
Thread32Next
Thread32First
SuspendThread
Sleep
HeapReAlloc
HeapAlloc
GetThreadContext
SetThreadContext
OpenThread
VirtualQuery
InterlockedFlushSList
RtlUnwind
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
CreateFileW
GetDriveTypeW
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetModuleFileNameA
GetACP
GetCurrentDirectoryW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
RaiseException
user32
PostThreadMessageW
PeekMessageW
MessageBoxW
GetDesktopWindow
advapi32
AdjustTokenPrivileges
OpenProcessToken
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
RegQueryValueExW
LookupPrivilegeValueW
ws2_32
ntohl
shutdown
listen
WSAStartup
getpeername
getsockname
send
socket
ntohs
select
inet_ntoa
recvfrom
recv
getsockopt
htonl
htons
sendto
ioctlsocket
setsockopt
WSAGetLastError
closesocket
bind
accept
__WSAFDIsSet
connect
msvcrt
strncpy
iphlpapi
GetInterfaceInfo
psapi
GetMappedFileNameW
shell32
SHGetFolderPathW
Sections
.text Size: 428KB - Virtual size: 428KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sedata Size: 829KB - Virtual size: 832KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.sedata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
REMCOS v1.7 Professional/Remcos Loader.exe.exe windows:5 windows x86 arch:x86
Password: 777
28751844dec40b40bddaf2626843d3ee
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WriteProcessMemory
LoadLibraryA
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
user32
GetMessageW
CharUpperBuffW
psapi
GetModuleFileNameExW
wtsapi32
WTSSendMessageW
advapi32
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
Exports
Exports
Sections
.text Size: - Virtual size: 42KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: - Virtual size: 172B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 1.8MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 136B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
REMCOS v1.7 Professional/desktop.ini
-
REMCOS v1.7 Professional/remcos.exe.exe windows:5 windows x86 arch:x86
Password: 777
e2c065b1c331512012c564526756d6f2
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
oleaut32
SysFreeString
SafeArrayPtrOfIndex
GetErrorInfo
advapi32
RegQueryValueExW
RegUnLoadKeyW
RegCloseKey
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
user32
CharNextW
SetClassLongW
EnumDisplayMonitors
CharUpperBuffW
kernel32
GetVersion
GetProcAddress
GetVersionExW
GetVersion
Sleep
LoadLibraryA
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
gdi32
UnrealizeObject
version
VerQueryValueW
netapi32
NetWkstaGetInfo
ole32
OleUninitialize
comctl32
InitializeFlatSB
msvcrt
memset
shell32
SHGetFileInfoA
wininet
InternetCheckConnectionA
comdlg32
GetSaveFileNameW
winspool.drv
OpenPrinterW
GetDefaultPrinterW
wsock32
WSACleanup
winmm
waveOutWrite
wtsapi32
WTSSendMessageW
Exports
Exports
TMethodImplementationIntercept
__dbk_fcall_wrapper
dbkFCallWrapperAddr
��U�*r,���+�>b�A��烤6��j⺳���ئ�����d��0���X���Q ���ZJf��&8U^>�d�tG����;d@`�4� ^�N[]�p_�1�.�n�����k�÷�&pe?+^��S�#M�k�b� ���ϭ�Q���2��c7��.n�;��Y���%4�7G<\v�)��@:�tEH�&n��-^/ZR��/�� ��^�FZ��v�=����A�I��l~�X�K��E���� ��U?�T)�8�~Gy�s��k���}ڤ�����.���B �Y�v�X~�����!Q������(k�pD�ėݻek7�nʁ"�q�yp�j\:J�4:��7�t"�� �Ɏ�|Էu����*���Ɗ�T�M��H��}*���[�k nqG��p��5%ěлri����ZnY�F^�C��F���q/���DE��'fL/-�[�u�x�dM�K+��o�} ��9����=l��M�nI\����n�G�I*�cc��h�:I��BEqϽ��� t&�h�JDk�ͣ~��S� x�iF��j�<H���#]Z�Af&�Ϥ���e �N�@q�t#h��3_j�� ���RQ0W>���*����<\_�j���2�H�C�&��)�\�X��&�!4,��p $K������g���T�"�4��gtH:�@m����,���<z�|]����}]����E�"S���C�r����\�JIwD�*�r.X}{bWV�v�{�q;���W���DR�<��0 I��H��ͼ6�*���Q���r�&&ec��$��!d�kߒ����q1�(�IT� �}h(U{[u����wp�:Sv���/�Z���` p��HѠ��:�{[\PҨ�2jy��f�R�6�C�B�կ���$�h�Qw�צ�� ���`��l�XeQH�G��������4�m`��B������N�ɳ��(��*�h\��� �"��ms���<�, �����f��o��w�V�`��;����~pJ�ړ���}!��s=Ve�����#��6�B�k������ٸy���Ձ$��h�֜=�L���:-�کO|[�${z%F|թ��������t�a-B������\7])��5��H�B����Ր%��j�y�?���O0ORU�G�l:ԟϵY�Q?x�c?�|�����u[�b{$`0����� ��HM§w֭n1�����Ι�f� �!g�9����˴�=�5�U�eؔ��t�u{��7�f��]�!M�c�:���ÀvVmͣ��{��4�P@$dez�GO�O��oQoC�f=A� 1z9�c���ན�� OF�����>���:|�O��aF�K71ō�� J��&��K�����ŔY�h�Xx�۟�-����c�:�Vo������?O��R������ha�eQ�����2f�P3E4�T �`�+�@�nj�T�Υ�nq�\�I�6t������T5�9����RKg3�Tޞ���7t%�M�1�����u��gy��_v��C9K��+5Ѥx�òWp=ѥ�����e����.�w��:����I#����� �t�|M� �''$��$���.���X�n�x7@ �gI���c[:�����'�K��C�f�j���-7<�xD�?�9Z��:���0��!��V�y:�3���'Q�5iC�az�DMe�L3�{�vQ���m �PΝyK&u���dX���ɣ�L�7s���{���sٖ^��[���3�zo�>]�:vұ����1g�7��E�h����k�@�2�,H,��^���2I7-1r�� �p��h�H@#���9�ŭ�99����-� K��l��+�G�]<P�wz++�G�o��mY�C�"�s����~ۅ����Rv磏?'�BTg���}_t�Y1/�A��>��%n/ ��h +�q��k�q8� ��kJkSZf��$W=;L�y��������-l �5��r������.{!���,+�|Ⱥ��Hȡ�v��8d��J��oa�z��ݼl�//�+���bz��cJ5Qy@�s�<���b�{�9~ʾ�R,��(�����ʠ N�5����05����<����f�3��TyA�{�� ¬:��L���\�m{��YT���X�g�x��꺙�p �l7�����>L����� s�p�o���O �uq�R�ޢ�f��P�3/�����N���d�� /X�_v���݉�4Fk]�&sJݱ�}�ђ'�Vk��i�U��zE\���)���k����5�k�d��t���|b�H-�tJp�^˗�\� �R(/ ��@{+�!�&F���Q�g��"O����?$���]�HY�ОB:F�W��/���<*4��G�8?9��XԲ�M��2C ���=j�;ఠR����Lx�d�`"���i����9�� �6��N���VnS��j�#$�*r����J��(46��}���!�� u�^�EK H!ir�A�����7�Mx��D��,��GƎ�nA m�'�g������>� �6s�4�ⶥK%�AYS `�f��v:��ã�C¤,���@!����n�v8Dk�K�����j��6�wg�5����K{�c�H����w ߩ[�8;�A�vQF����?�|[O�ą'��� �65�/T�?❓PP4�Q6�$vi;L(����q>�����p�fRJ�2x{H~����}�I�Y�k��0���8>�p}z(->��? uR�{�y��ⲙ�`��H-�D!���w�>���b9���Z����������`~L͖���|D�� �\��]�ɓ�{�0/\lr���ENz�k;�$����U����� G�����!g��$a�W�1 ���q�Pp+�_����pV��?�̓ƫ�R��n_�5��E�-T�0���TH��� �!9���N���H��ϒ~}���>�������a��B4�|5���&.� F٩�gy�~� ��"ߐ�����������G���1r"��QN#���j�D�`z�.����a��>J`��'� ����̱����mV�σi�����Ŀ��A�jo8������@�o j� ��
Sections
.text Size: - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 104KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.didata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: - Virtual size: 154B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: - Virtual size: 76B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 93B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.viotto0 Size: - Virtual size: 9.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.viotto1 Size: 9.6MB - Virtual size: 9.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 282KB - Virtual size: 281KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ