remcos

General

Target

PAMELA+2023+ORGANIZERpdf.tar
Size

3.7MB
Sample

240808-q7r5csthrj
MD5

51736c030566d83e32dcc5f2b20631f3
SHA1

5b3d248cff677d9c859269daf529c2c7ff34d78a
SHA256

553bd8b6c13d775bbaa9c5b2d9c02ee8df0e232180dfd17c5f7a67188bb3e218
SHA512

de8fbddbbca2e2d0d7f0d204c2e1a82e26235c901ba40d62aae61a7b46658e6da2c1f4192f44d500e7d3f6a2939bfc5cdacbefd8f6f678f37676ea2437ebe045
SSDEEP

49152:X55p1wTHyQhBCMsvEqyeBiDw0uJzkiaWwj+4VWnoqSkHNckbfH6lJ2XgKmf:pr1wTHF5svP1YDw0UzfaWwCUktFTOPK

Score

10^/10

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

privmerkt.com:6042

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-BMG9AW
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Targets

- Target
  
  TaxDocuments.exe
- Size
  
  1.7MB
- MD5
  
  30307b319b2451b6bf61d3e6b232f1da
- SHA1
  
  6a512848872be1325761e7ca110e0a1ee91cb0ef
- SHA256
  
  a7dbbad8a1cd038e5ab5b3c6b1b312774d808e4b0a2254e8039036972ac8881a
- SHA512
  
  7833ecb30a75324af6852e3583a609a653652f3cda9037ace7a1098ce7e52ed4b994c5ff1a0a0b4db748a01b06e8d4b8a10a50ebb9c0d4fbc8aa12dd1168f0b7
- SSDEEP
  
  24576:17AMY27PG+4VWz3zYxQ2IQKbvavAyoVVxPuOcabAC9fH6lJUkwJYaTTgKmfa8+:Nwj+4VWnoqSkHNckbfH6lJ2XgKmf+
Score

10^/10

remcos remotehost discovery persistence rat
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Adds Run key to start application
  persistence
- Suspicious use of NtCreateThreadExHideFromDebugger
behavioral1 behavioral2
- Target
  
  msimg32.dll
- Size
  
  2.0MB
- MD5
  
  76ee9007534b3b29067359f75b3e6796
- SHA1
  
  a2f76600ea6f9c62ea14e2ee0298d35901f757de
- SHA256
  
  fb0baf9e8ba136ea0c99e40f313f320f6715e47f5b947bcc0d1d2b8ce4ddeb9c
- SHA512
  
  d13f6befde057b1b0009d57ef7dc01978efde365a7427c2eea1b9708a2128b905af96600b6ac9d947f36b6399c6c170ea0e57c30dae8eaf07b8a21561861bbae
- SSDEEP
  
  24576:GoI7IMF8xqQ5Ygi0k+KieSp5Qm23cvJTnM5fMG52MRpwnQZ2o67axBCMAFvEq0cf:H55p1wTHyQhBCMsvEqyeBiDw0uJzkiai
Score

10^/10

remcos remotehost discovery persistence rat
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Blocklisted process makes network request
- Adds Run key to start application
  persistence
- Suspicious use of NtCreateThreadExHideFromDebugger
behavioral3 behavioral4