remcos

General

Target

a96067cac28b1f5c3de4e1b6c7d0a402_JaffaCakes118
Size

233KB
Sample

240819-dvjk8s1fpa
MD5

a96067cac28b1f5c3de4e1b6c7d0a402
SHA1

51c65c8ece4bfd5c7d1b09105440f3f02d3b14ca
SHA256

79e70809a85e291f9da3d391131208ce7645dd512eb6bb71811154b43da23222
SHA512

1627058a9a884965bce4ece1ccf03c24a849cd79fe883c923ae2eb56c8e0bbb730cf823e550c080685af1f906a38f2847a65dc8ed236181d97eee9ddcfc3f96e
SSDEEP

6144:SqjIxGscXRNClwLJwAEZgVWnjNBjKTkst:jDduKmLyr

Score

10^/10

Malware Config

Extracted

Family

remcos

Version

2.7.2 Pro

Botnet

RemoteHost

C2

103.89.88.238:4299

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
excel.exe
copy_folder
excel
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
excel
keylog_path
%AppData%
mouse_option
false
mutex
excel-8OHAVR
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
excel
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
wikipedia;solitaire;

Targets

- Target
  
  a96067cac28b1f5c3de4e1b6c7d0a402_JaffaCakes118
- Size
  
  233KB
- MD5
  
  a96067cac28b1f5c3de4e1b6c7d0a402
- SHA1
  
  51c65c8ece4bfd5c7d1b09105440f3f02d3b14ca
- SHA256
  
  79e70809a85e291f9da3d391131208ce7645dd512eb6bb71811154b43da23222
- SHA512
  
  1627058a9a884965bce4ece1ccf03c24a849cd79fe883c923ae2eb56c8e0bbb730cf823e550c080685af1f906a38f2847a65dc8ed236181d97eee9ddcfc3f96e
- SSDEEP
  
  6144:SqjIxGscXRNClwLJwAEZgVWnjNBjKTkst:jDduKmLyr
Score

10^/10

remcos remotehost discovery persistence rat
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  11KB
- MD5
  
  fccff8cb7a1067e23fd2e2b63971a8e1
- SHA1
  
  30e2a9e137c1223a78a0f7b0bf96a1c361976d91
- SHA256
  
  6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e
- SHA512
  
  f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c
- SSDEEP
  
  192:xPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4v:g7VpNo8gmOyRsVc4
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  
  nhop.dll
- Size
  
  16KB
- MD5
  
  ff98a06930bd4c0a11500f2378f23ffa
- SHA1
  
  c25a3da1562f0dc0247140ff8636c88a843e9a66
- SHA256
  
  97cc714ecc6d201ff90e6947bedf9345dd9f0abffaa0687607d216f4567dfbd9
- SHA512
  
  8e33d253610a07c6603c6da9714bc18f2b9a6f3e229fd5d9873783ce842214689e3296bb37864720ca561a74b72beb5f7852ae3a732f4ec85c046646acd25916
- SSDEEP
  
  384:ckxk55jKeh7Wvh8uAWsje/ajFfwsNvtReRSY6bJDb9:cJwwqvh8uAIG2sNVRISY6N
Score

6^/10

discovery persistence
- Adds Run key to start application
  persistence
behavioral5 behavioral6