remcos

General

Target

199db74699251a30044f0a2e0eadd51cbbee650d61e10b75bd8eb0064c1fef2d.zip
Size

37.6MB
Sample

240907-bet1xswhjk
MD5

fabf407c929745d9cc96b0f7025a0929
SHA1

f891fc3ca93267847430e6a8016d9565a9e9e024
SHA256

199db74699251a30044f0a2e0eadd51cbbee650d61e10b75bd8eb0064c1fef2d
SHA512

066d0272f1d580955bb0f60066065014119e9de1e7815a64ef3a9e2ba1c54ab92eb49993e40af737c554e8bff61cf1badd2ffcfc109b449d4fadfa99b965d9a5
SSDEEP

786432:tEawiSHzS1rJso+RcGKIgLr0KP8rkGJP6gcTQPbBS6tYZj6Yx8lA94d:tEaSHqJBaXkHDP8rfJP6HTQPbg6tzYxQ

Score

10^/10

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

privmerkt.com:6042

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-XE94AK
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Targets

- Target
  
  2023 HSA.ren
- Size
  
  50.1MB
- MD5
  
  b7218d6c565e49c2ad9790f11403ffbf
- SHA1
  
  329460f4b59009c6e1bd1aeab1bd4575f9618cf0
- SHA256
  
  54703339d746a7405ce6db2f292fe0238ba45f8bb9fccd0f382e972948c54d43
- SHA512
  
  de321595ced13ee0c62e11a960a0e4981c70296e44b4a9d933f79a9d776f2f11c9285a00372bc70e83bb1bd60390420dec343e19588deefd092cfccd5e339a25
- SSDEEP
  
  786432:c5XPGmWrKMKU4tZugPuPoq9xykmpWLFmS6BGjvo2Z:iP5ED6ztPuPD9xyjpWLFp6Bn2Z
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  
  2023 Schedule C.exe
- Size
  
  6.1MB
- MD5
  
  4864a55cff27f686023456a22371e790
- SHA1
  
  6ed30c0371fe167d38411bfa6d720fcdcacc4f4c
- SHA256
  
  08c7fb6067acc8ac207d28ab616c9ea5bc0d394956455d6a3eecb73f8010f7a2
- SHA512
  
  4bd3a16435cca6ce7a7aa829eb967619a8b7c02598474e634442cffc55935870d54d844a04496bf9c7e8c29c40fae59ac6eb39c8550c091d06a28211491d0bfb
- SSDEEP
  
  98304:VZQIM+/nv/CDoAkYwpAa5ge1zZ/jtdZwUkQ:bJCKlA2VKUz
Score

10^/10

remcos remotehost discovery persistence rat
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Adds Run key to start application
  persistence
- Suspicious use of NtCreateThreadExHideFromDebugger
behavioral3 behavioral4
- Target
  
  msimg32.dll
- Size
  
  2.9MB
- MD5
  
  abd99b6d60ee5d44f0e5448d3947b281
- SHA1
  
  ef799bbe58d3d576e9e27e60e17e071725c975d8
- SHA256
  
  5b1aa2286d1b856ce45fc1bf075f36454aaac664460afb91185c4cc451291b62
- SHA512
  
  faf79a91f57c1e1c863e75614c0f4c9fb0acabdf7d4097c1554f09e1aef14f8efc0de3bc4261f3728da77fc548878532ceb1f76a1db1df485fcc10772419379c
- SSDEEP
  
  49152:hk8XGHSOdOoyWzL/bI7UAnuqSrtdBDmfKtTaeBiDw0uv+Kx55+v0UbpeQM/TNSWs:XGy0FfDEUYuqSvBDmS3YDw0+eha78
Score

10^/10

remcos remotehost discovery persistence rat
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Blocklisted process makes network request
- Adds Run key to start application
  persistence
- Suspicious use of NtCreateThreadExHideFromDebugger
behavioral5 behavioral6