remcos

General

Target

Jessica+Release.zip
Size

62.7MB
Sample

240906-r5xshasaqp
MD5

f71213b8589cb32ab20cd32a746276f8
SHA1

c670b405ca7494bf47da5243c00e54c903b29a28
SHA256

8fb0916a58f9b1d17d00504e4ff24d8a8ce8915d1c9dcb58a6b2d818fdb3967e
SHA512

52c871f485f153e69d28009ec1714971f970734fda61522f4710daaf5b20558b93aa9f9235f1914ecf4b65b00d31b66386f9263014428a5b4c3222b6e26aecea
SSDEEP

1572864:7aSHColmqvYvbN919l8iw/kQ5Sh9hmAljtB5xUev:7aUFvajlvWkQ5+zlBZ7

Score

10^/10

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

privmerkt.com:6042

nwemarkets.com:5290

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-RIFKGX
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Targets

- Target
  
  Prof-Loss stmt & W2.exe
- Size
  
  6.1MB
- MD5
  
  4864a55cff27f686023456a22371e790
- SHA1
  
  6ed30c0371fe167d38411bfa6d720fcdcacc4f4c
- SHA256
  
  08c7fb6067acc8ac207d28ab616c9ea5bc0d394956455d6a3eecb73f8010f7a2
- SHA512
  
  4bd3a16435cca6ce7a7aa829eb967619a8b7c02598474e634442cffc55935870d54d844a04496bf9c7e8c29c40fae59ac6eb39c8550c091d06a28211491d0bfb
- SSDEEP
  
  98304:VZQIM+/nv/CDoAkYwpAa5ge1zZ/jtdZwUkQ:bJCKlA2VKUz
Score

10^/10

remcos remotehost discovery persistence rat
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of NtCreateThreadExHideFromDebugger
behavioral1 behavioral2
- Target
  
  W2_PDF.i
- Size
  
  60.2MB
- MD5
  
  d2a996ede857240453d45d21b7cf9cbe
- SHA1
  
  d97838cdad84c4fdbd1d2d55cb9d7c289351ae7e
- SHA256
  
  c462b34faf0ea8af62c8fee3b65797371e6fb261d6760e4f0ae472127cafd944
- SHA512
  
  72474c2fca39e5b7fb33a8f15072c4b771c267e0c1a47ce9d8e5f39740ae2afdef78d08cda91fd0841de7bb25cc4aedfc13c43719436fa4ff338c4a02ffd0151
- SSDEEP
  
  1572864:ddmZ92bucLNrpf5/NOCJRHeyT55JJHtHYT5IhSSkIrx0:ddM92bucxfNlJhj5nZYTcSS7re
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  
  msimg32.dll
- Size
  
  1.4MB
- MD5
  
  4b0892a87745e1cbb805f4893d844ff3
- SHA1
  
  9dbb4560de72f2a449db595c0ff28b22b320ecfd
- SHA256
  
  947ba630b4d2d998525eff4f08a5f9a0f45052b51fab71c7838ffae57ab0e4f5
- SHA512
  
  a92aa599592714f42e884928c8afd6f88e83c7c13d9330d4a1da70c35f1d85a95ead965158006adca2caec11d8c6922e70004f8531f0547776aa1f28fbda1e3c
- SSDEEP
  
  24576:WacJJPFJ/ti1GJQva0cceV+Atxdl8HCb7PiZ6vvYIerK67eBiDw0ueAwwSg3D6d0:W9JJPFJ/ti1GJQva0cceV+Atxdl8HCbd
Score

10^/10

remcos remotehost discovery persistence rat
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Blocklisted process makes network request
- Adds Run key to start application
  persistence
- Suspicious use of NtCreateThreadExHideFromDebugger
behavioral5 behavioral6