remcos

General

Target

c8cd3c8b932d0d8bb2b9b851259e85af_JaffaCakes118
Size

533KB
Sample

240829-pf3lcashnl
MD5

c8cd3c8b932d0d8bb2b9b851259e85af
SHA1

e15440e53ef1673ac4816ffc80aed3cbee348a6c
SHA256

e759db35e2aa047d055ca4d5d089da667aaa39d443a35601784090382f0d1e2a
SHA512

644d18526e1020417fc51cd967117eb3ec1635f836a229deebfdf3be5517fe151389dd2fa1b17baeb1312bfc71e52167e37c2b949eecef50c2745d5c535340c6
SSDEEP

12288:rq9xZoOJR0yS6PV+RTRicEsuDKkKX/0lDQS0mdJh4:W5oYRB+773spFX4

Score

10^/10

Malware Config

Extracted

Family

remcos

Version

3.0.0 Pro

Botnet

money

C2

cjmoneykelvincrugar.duckdns.org:20944

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
excel.exe
copy_folder
excel
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
excel-ETNYHC
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
excel
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
wikipedia;solitaire;

Targets

- Target
  
  c8cd3c8b932d0d8bb2b9b851259e85af_JaffaCakes118
- Size
  
  533KB
- MD5
  
  c8cd3c8b932d0d8bb2b9b851259e85af
- SHA1
  
  e15440e53ef1673ac4816ffc80aed3cbee348a6c
- SHA256
  
  e759db35e2aa047d055ca4d5d089da667aaa39d443a35601784090382f0d1e2a
- SHA512
  
  644d18526e1020417fc51cd967117eb3ec1635f836a229deebfdf3be5517fe151389dd2fa1b17baeb1312bfc71e52167e37c2b949eecef50c2745d5c535340c6
- SSDEEP
  
  12288:rq9xZoOJR0yS6PV+RTRicEsuDKkKX/0lDQS0mdJh4:W5oYRB+773spFX4
Score

10^/10

remcos money discovery persistence rat
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  11KB
- MD5
  
  fccff8cb7a1067e23fd2e2b63971a8e1
- SHA1
  
  30e2a9e137c1223a78a0f7b0bf96a1c361976d91
- SHA256
  
  6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e
- SHA512
  
  f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c
- SSDEEP
  
  192:xPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4v:g7VpNo8gmOyRsVc4
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  
  oird.dll
- Size
  
  61KB
- MD5
  
  cf4ae210908c96902bc5b7f418bc07f2
- SHA1
  
  17b7e94ab427967f73496882207a857eaf32f4d8
- SHA256
  
  d2cbc91d8a57bbcb023ae76bf4d53f2e77a06df828c78ec23ddcf9be333a2d45
- SHA512
  
  234fc71cd2acc461a84b762f2ac73d736ca2844a4d2fd4003e438e1ee3fcde07778c562b9b92d672c7c8cef18c14764bb7b8d9393f68e1ea8c471fdac9c2ac70
- SSDEEP
  
  1536:3kenDMLT/44vMGrYZYPsrqN6hBsmM3erDx:UIgLTj9kSPsmN6MmM3erD
Score

6^/10

discovery persistence
- Adds Run key to start application
  persistence
behavioral5 behavioral6