remcos

General

Target

bfcd80a380ccb9fd6c8e44c41ca77adc_JaffaCakes118
Size

166KB
Sample

240825-a9wbsszapf
MD5

bfcd80a380ccb9fd6c8e44c41ca77adc
SHA1

c0445f0121e1cd76f838a7bb95d120383804eaf1
SHA256

d4e2d35182ab1f55d6a0dee8ecdf3ba1b1df2bd0fda384f25335feb42ae31cfa
SHA512

03e6a52936cbecbfe96e084ec49933a20b1a5e9952ad609ed6498576a22d8f508e5aa3c1f52e835adda749d6b7fdb6728651594fd65e02d26e61c4049871ab94
SSDEEP

3072:LPlI2zV0e/MCB3HXAR+gozkSIRHwrliH0sNlNY89+u1PjBM64MZLbB0zewoS:L69OMIHww/jsNfSuZazuLbBnwx

Score

10^/10

Malware Config

Extracted

Family

remcos

Version

2.7.2 Pro

Botnet

RemoteHost

C2

nikkihutsltd.duckdns.org:19139

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
chrome
copy_folder
chrome
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
chrome
keylog_path
%AppData%
mouse_option
false
mutex
chrome-T2ENBJ
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
chrome
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
wikipedia;solitaire;

Targets

- Target
  
  QUOTATION.exe
- Size
  
  181KB
- MD5
  
  40361eb24f8fb52b2a653a55afec7952
- SHA1
  
  d8bc9d3adac423aee35fc65a224c820eae9ec063
- SHA256
  
  a134e9815c6d82b5dd7589b78c3d3ac93f7fbc9ee24072748bd53cdf63164d1c
- SHA512
  
  b79fab70b89781b951bbdc5048aca34001d403a3cde4800c7ef94fdb3d3370439920606142579e51800bad681443c16970049535fd24a81897d723a83992e8d8
- SSDEEP
  
  3072:4BkfJpRXATwMdFCcob0Z5EcwGXBPWsJzSSFteC7rJpQyjdRjAz+eFXerwxHHYMKy:4qjIQCE3GXBPWLSFteC7rT93jDAXeqH9
Score

10^/10

remcos remotehost discovery persistence rat
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  11KB
- MD5
  
  fccff8cb7a1067e23fd2e2b63971a8e1
- SHA1
  
  30e2a9e137c1223a78a0f7b0bf96a1c361976d91
- SHA256
  
  6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e
- SHA512
  
  f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c
- SSDEEP
  
  192:xPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4v:g7VpNo8gmOyRsVc4
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  
  k08cwjcrlzilk8t.dll
- Size
  
  13KB
- MD5
  
  05ad6c2690084ff9cc4ff14b455b781e
- SHA1
  
  9b0ff8da652e83aa675bfc5fd7d5c9173d134509
- SHA256
  
  97de472526c14080264663f4b729df51c4208a1e37d190a0412076a682f0aa7b
- SHA512
  
  e48f4b3ac853d6669f5e9f2dd7516eb268941f50189e6f99a7d5f4ef9bab88709bc6c9c02267e6f61659dba50c67163481376c3cb6d4e5bc7a6641f15b9e309e
- SSDEEP
  
  192:hMvg35NXh2oeh05mdX7zAnMVm8j5Ykrx/FTwB72yUnbcpAY05ASxVkEw6ZIYNQ:hM8X2/Dhvp7Bx/K4bcpgASEE3ZlN
Score

6^/10

discovery persistence
- Adds Run key to start application
  persistence
behavioral5 behavioral6