remcos

General

Target

10092024_1747_10092024_PJ-24-PCBN0190.rar
Size

428KB
Sample

240910-wc1qxawerr
MD5

0879489e0037863844d1a4bd7e7a71a9
SHA1

8a426acb8309a949e4ef4a4628b5c92e94cadb9b
SHA256

a217f639b91625bff1a888e42aafaf1d69a3b04bd4b4f83b29fa12b04903fd42
SHA512

719117ca4f114ad4c6d7e96446c43d182ff7ebc3ae72d8389a634c96bfe79ed52da1bbdd04d8663654fb2d81d62aa5cf8bd6b80d9d55006ba75bda7233026a38
SSDEEP

6144:FeIZDoU6ub6PCbHYyl0kW5eOjaDiUx5H3+BKPqXaP9OIGjK9x4LIaQu9BVCkdjMF:F3D8M3bHNOheH3+sSXxIDaQqnMzB

Score

10^/10

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

38.132.122.173:2404

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-78GP4R
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Targets

- Target
  
  PJ-24-PCBN0190.exe
- Size
  
  506KB
- MD5
  
  391eb6e1d6d588a51adc83ccf70fbaca
- SHA1
  
  e4154f4786be22e960fe94abd39caadbbcd29745
- SHA256
  
  7c5e6bd087ef9714cfaf90856d1db5a5cf8bab4d7f1688a214a4b3b90014476b
- SHA512
  
  bc5cf53b786e5752be814271c09d25cd16aa3a44ee0bec177465f8d5fdbaac8be82642fdfbbc6f0398aa815597ed27ba53a78a44cc2de25fc87aec905a248620
- SSDEEP
  
  12288:9o+VIWBonT8umPHsk2kpMkOFd9/vnUL5IyaXXPF:O+VIWCnT8dPskdq9/vUlGPF
Score

10^/10

remcos remotehost discovery rat collection credential_access spyware stealer
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Detected Nirsoft tools
  Free utilities often used by attackers which can steal passwords, product keys, etc.
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook accounts
  collection
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  11KB
- MD5
  
  3f176d1ee13b0d7d6bd92e1c7a0b9bae
- SHA1
  
  fe582246792774c2c9dd15639ffa0aca90d6fd0b
- SHA256
  
  fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e
- SHA512
  
  0a69124819b7568d0dea4e9e85ce8fe61c7ba697c934e3a95e2dcfb9f252b1d9da7faf8774b6e8efd614885507acc94987733eba09a2f5e7098b774dfc8524b6
- SSDEEP
  
  192:OPtkumJX7zB22kGwfy0mtVgkCPOsX1un:/702k5qpdsXQn
Score

3^/10

discovery
behavioral3 behavioral4