remcos

General

Target

fabf407c929745d9cc96b0f7025a0929.bin
Size

37.5MB
Sample

240908-cf4ges1bpg
MD5

5501e5fff5ee9ae802fa8edb416c4b65
SHA1

0f6cf5933e1fb5e52e0b21523ea11bc492637d09
SHA256

fd1f22bc2ba7e424aefb96a8871bb40f1b051e4e2620ad1d9e00347e521e671f
SHA512

80d6867996dc6fc5daae2ef5fc1abc291317db5705b5c29b4b64f22a3f871a0b859b3f108989ddbcb91aa138eb42c0954995b832aebb781541043362442df6c2
SSDEEP

786432:VS5UO/DdxfJ4WjXjrrvrlsc17kXfM2yh/3qn+oqUqbUh:VjS/br7R1wFyh/3KQgh

Score

10^/10

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

privmerkt.com:6042

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-XE94AK
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Targets

- Target
  
  2023 HSA.ren
- Size
  
  50.1MB
- MD5
  
  b7218d6c565e49c2ad9790f11403ffbf
- SHA1
  
  329460f4b59009c6e1bd1aeab1bd4575f9618cf0
- SHA256
  
  54703339d746a7405ce6db2f292fe0238ba45f8bb9fccd0f382e972948c54d43
- SHA512
  
  de321595ced13ee0c62e11a960a0e4981c70296e44b4a9d933f79a9d776f2f11c9285a00372bc70e83bb1bd60390420dec343e19588deefd092cfccd5e339a25
- SSDEEP
  
  786432:c5XPGmWrKMKU4tZugPuPoq9xykmpWLFmS6BGjvo2Z:iP5ED6ztPuPD9xyjpWLFp6Bn2Z
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  
  2023 Schedule C.exe
- Size
  
  6.1MB
- MD5
  
  4864a55cff27f686023456a22371e790
- SHA1
  
  6ed30c0371fe167d38411bfa6d720fcdcacc4f4c
- SHA256
  
  08c7fb6067acc8ac207d28ab616c9ea5bc0d394956455d6a3eecb73f8010f7a2
- SHA512
  
  4bd3a16435cca6ce7a7aa829eb967619a8b7c02598474e634442cffc55935870d54d844a04496bf9c7e8c29c40fae59ac6eb39c8550c091d06a28211491d0bfb
- SSDEEP
  
  98304:VZQIM+/nv/CDoAkYwpAa5ge1zZ/jtdZwUkQ:bJCKlA2VKUz
Score

10^/10

remcos remotehost discovery persistence rat
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Adds Run key to start application
  persistence
- Suspicious use of NtCreateThreadExHideFromDebugger
behavioral3 behavioral4
- Target
  
  msimg32.dll
- Size
  
  2.9MB
- MD5
  
  abd99b6d60ee5d44f0e5448d3947b281
- SHA1
  
  ef799bbe58d3d576e9e27e60e17e071725c975d8
- SHA256
  
  5b1aa2286d1b856ce45fc1bf075f36454aaac664460afb91185c4cc451291b62
- SHA512
  
  faf79a91f57c1e1c863e75614c0f4c9fb0acabdf7d4097c1554f09e1aef14f8efc0de3bc4261f3728da77fc548878532ceb1f76a1db1df485fcc10772419379c
- SSDEEP
  
  49152:hk8XGHSOdOoyWzL/bI7UAnuqSrtdBDmfKtTaeBiDw0uv+Kx55+v0UbpeQM/TNSWs:XGy0FfDEUYuqSvBDmS3YDw0+eha78
Score

10^/10

remcos remotehost discovery persistence rat
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Blocklisted process makes network request
- Adds Run key to start application
  persistence
- Suspicious use of NtCreateThreadExHideFromDebugger
behavioral5 behavioral6