remcos

General

Target

f71213b8589cb32ab20cd32a746276f8.bin
Size

62.7MB
Sample

240908-cfvjhsycqq
MD5

43d79c127b3ee1750b395bcb0b7420dc
SHA1

93a44522be3b1015a190bba0203f7df5ce2173ab
SHA256

e81a97f6711b16f4afc864f0d0ad9d83fb62bfd78c2c22e1f0bf0bb6dce8a45c
SHA512

cbc59d0625b0b6d716cb64cd4172222a27649eaf22620b248646ce2f8b8c12fb9f51fb772b22883e1d63f2395dfe67183bb59152d93d1f44542cd777c6291db6
SSDEEP

1572864:oOXW/hJ4YQgZ6GUEH5+LccMchXR61X1/HSIngvaazseqhkiG:oO2J4YQs6G5H5+LlLXRm/HSlffqhkB

Score

10^/10

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

privmerkt.com:6042

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-RIFKGX
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Targets

- Target
  
  Prof-Loss stmt & W2.exe
- Size
  
  6.1MB
- MD5
  
  4864a55cff27f686023456a22371e790
- SHA1
  
  6ed30c0371fe167d38411bfa6d720fcdcacc4f4c
- SHA256
  
  08c7fb6067acc8ac207d28ab616c9ea5bc0d394956455d6a3eecb73f8010f7a2
- SHA512
  
  4bd3a16435cca6ce7a7aa829eb967619a8b7c02598474e634442cffc55935870d54d844a04496bf9c7e8c29c40fae59ac6eb39c8550c091d06a28211491d0bfb
- SSDEEP
  
  98304:VZQIM+/nv/CDoAkYwpAa5ge1zZ/jtdZwUkQ:bJCKlA2VKUz
Score

10^/10

remcos remotehost discovery persistence rat
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Adds Run key to start application
  persistence
- Suspicious use of NtCreateThreadExHideFromDebugger
behavioral1 behavioral2
- Target
  
  W2_PDF.i
- Size
  
  60.2MB
- MD5
  
  d2a996ede857240453d45d21b7cf9cbe
- SHA1
  
  d97838cdad84c4fdbd1d2d55cb9d7c289351ae7e
- SHA256
  
  c462b34faf0ea8af62c8fee3b65797371e6fb261d6760e4f0ae472127cafd944
- SHA512
  
  72474c2fca39e5b7fb33a8f15072c4b771c267e0c1a47ce9d8e5f39740ae2afdef78d08cda91fd0841de7bb25cc4aedfc13c43719436fa4ff338c4a02ffd0151
- SSDEEP
  
  1572864:ddmZ92bucLNrpf5/NOCJRHeyT55JJHtHYT5IhSSkIrx0:ddM92bucxfNlJhj5nZYTcSS7re
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  
  msimg32.dll
- Size
  
  1.4MB
- MD5
  
  4b0892a87745e1cbb805f4893d844ff3
- SHA1
  
  9dbb4560de72f2a449db595c0ff28b22b320ecfd
- SHA256
  
  947ba630b4d2d998525eff4f08a5f9a0f45052b51fab71c7838ffae57ab0e4f5
- SHA512
  
  a92aa599592714f42e884928c8afd6f88e83c7c13d9330d4a1da70c35f1d85a95ead965158006adca2caec11d8c6922e70004f8531f0547776aa1f28fbda1e3c
- SSDEEP
  
  24576:WacJJPFJ/ti1GJQva0cceV+Atxdl8HCb7PiZ6vvYIerK67eBiDw0ueAwwSg3D6d0:W9JJPFJ/ti1GJQva0cceV+Atxdl8HCbd
Score

10^/10

remcos remotehost discovery persistence rat
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Blocklisted process makes network request
- Adds Run key to start application
  persistence
- Suspicious use of NtCreateThreadExHideFromDebugger
behavioral5 behavioral6