remcos

General

Target
3a8b254e5d72bd8465898f3f7d3af731c103ad07b064a78f80b6f042213c66bd
Size 559KB
Sample241007-y9vbhasglk
SHA256 3a8b254e5d72bd8465898f3f7d3af731c103ad07b064a78f80b6f042213c66bd
MD5 1b2cbeac6edcd04ca160e8f73275d58e
SHA1 4eb5c4db67655932f0d904dc037b44b0d486158c
SHA512 6dba4d2c3781b16faecbeadcce20b3fd6245d89a3fd587521e71d228698a098622d7f9cbff1298aa20fb3a4007d8d61d8bb49e8990441add56782ccb35718fc6
SSDEEP 12288:oXXR47mwO8E0dAjNWiyfp0/mms22qBTO7hIB+J2W+ei:KXR47NTEWANRZsHgC7Y+AWm
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

kezdns.pro:2404

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-INFRLN
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Targets

- Target
  3a8b254e5d72bd8465898f3f7d3af731c103ad07b064a78f80b6f042213c66bd
- Size 559KB
- SHA256 3a8b254e5d72bd8465898f3f7d3af731c103ad07b064a78f80b6f042213c66bd
- MD5 1b2cbeac6edcd04ca160e8f73275d58e
- SHA1 4eb5c4db67655932f0d904dc037b44b0d486158c
- SHA512 6dba4d2c3781b16faecbeadcce20b3fd6245d89a3fd587521e71d228698a098622d7f9cbff1298aa20fb3a4007d8d61d8bb49e8990441add56782ccb35718fc6
- SSDEEP 12288:oXXR47mwO8E0dAjNWiyfp0/mms22qBTO7hIB+J2W+ei:KXR47NTEWANRZsHgC7Y+AWm
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

discovery remcos remotehost rat
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 7fb0f8d452fefaac789986b933df050f3d3e4feb8a8d9944ada995f572dcdca1
- MD5 dd87a973e01c5d9f8e0fcc81a0af7c7a
- SHA1 c9206ced48d1e5bc648b1d0f54cccc18bf643a14
- SHA512 4910b39b1a99622ac8b3c42f173bbe7035ac2f8d40c946468e7db7e2868a2da81ea94da453857f06f39957dd690c7f1ba498936a7aaa0039975e472376f92e8f
- SSDEEP 192:VFiQJ77pJp17C8F1A5xjGNxrgFOgb7lrT/993:97pJp48F2exrg5F/9
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 bcb93204bd1854d0c34fa30883bab51f6813ab32abf7fb7d4aeed21d71f6af87
- MD5 6c881f00ba860b17821d8813aa34dbc6
- SHA1 0e5a1e09b1ce1bc758d6977b913a8d9ccbe52a13
- SHA512 c78d6f43aa9bb35260a7bd300392ce809282660283fa6cb3059bae50d6db229b0b853cab7c949d4bdf19309fb183257b1c9feb01a66347e1c0adeb21543315b6
- SSDEEP 96:DOBtYZKtPsrqBApt1JHpb9XWk7Qe06iE6mE6YNFyVOHd0+ugwEX:DtZKtrAJJJbP7iEHEbN8Ved0PM
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral5 behavioral6

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Loads dropped DLL

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6