remcos

General

Target
fabf407c929745d9cc96b0f7025a0929.bin
Size 37.5MB
Sample240908-cf4ges1bpg
SHA256 fd1f22bc2ba7e424aefb96a8871bb40f1b051e4e2620ad1d9e00347e521e671f
MD5 5501e5fff5ee9ae802fa8edb416c4b65
SHA1 0f6cf5933e1fb5e52e0b21523ea11bc492637d09
SHA512 80d6867996dc6fc5daae2ef5fc1abc291317db5705b5c29b4b64f22a3f871a0b859b3f108989ddbcb91aa138eb42c0954995b832aebb781541043362442df6c2
SSDEEP 786432:VS5UO/DdxfJ4WjXjrrvrlsc17kXfM2yh/3qn+oqUqbUh:VjS/br7R1wFyh/3KQgh
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

privmerkt.com:6042

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-XE94AK
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Targets

- Target
  2023 HSA.ren
- Size 50.1MB
- SHA256 54703339d746a7405ce6db2f292fe0238ba45f8bb9fccd0f382e972948c54d43
- MD5 b7218d6c565e49c2ad9790f11403ffbf
- SHA1 329460f4b59009c6e1bd1aeab1bd4575f9618cf0
- SHA512 de321595ced13ee0c62e11a960a0e4981c70296e44b4a9d933f79a9d776f2f11c9285a00372bc70e83bb1bd60390420dec343e19588deefd092cfccd5e339a25
- SSDEEP 786432:c5XPGmWrKMKU4tZugPuPoq9xykmpWLFmS6BGjvo2Z:iP5ED6ztPuPD9xyjpWLFp6Bn2Z
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  2023 Schedule C.exe
- Size 6.1MB
- SHA256 08c7fb6067acc8ac207d28ab616c9ea5bc0d394956455d6a3eecb73f8010f7a2
- MD5 4864a55cff27f686023456a22371e790
- SHA1 6ed30c0371fe167d38411bfa6d720fcdcacc4f4c
- SHA512 4bd3a16435cca6ce7a7aa829eb967619a8b7c02598474e634442cffc55935870d54d844a04496bf9c7e8c29c40fae59ac6eb39c8550c091d06a28211491d0bfb
- SSDEEP 98304:VZQIM+/nv/CDoAkYwpAa5ge1zZ/jtdZwUkQ:bJCKlA2VKUz
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

remcos remotehost discovery persistence rat
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Adds Run key to start application
  persistence
- Suspicious use of NtCreateThreadExHideFromDebugger
behavioral3 behavioral4
- Target
  msimg32.dll
- Size 2.9MB
- SHA256 5b1aa2286d1b856ce45fc1bf075f36454aaac664460afb91185c4cc451291b62
- MD5 abd99b6d60ee5d44f0e5448d3947b281
- SHA1 ef799bbe58d3d576e9e27e60e17e071725c975d8
- SHA512 faf79a91f57c1e1c863e75614c0f4c9fb0acabdf7d4097c1554f09e1aef14f8efc0de3bc4261f3728da77fc548878532ceb1f76a1db1df485fcc10772419379c
- SSDEEP 49152:hk8XGHSOdOoyWzL/bI7UAnuqSrtdBDmfKtTaeBiDw0uv+Kx55+v0UbpeQM/TNSWs:XGy0FfDEUYuqSvBDmS3YDw0+eha78
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

remcos remotehost discovery persistence rat
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Blocklisted process makes network request
- Adds Run key to start application
  persistence
- Suspicious use of NtCreateThreadExHideFromDebugger
behavioral5 behavioral6