remcos

General

Target

a217006225f74ea5eaf76a0adcc006fd72b7a8a2a408b3f9f0ea370d1dc319b9.rar
Size

452KB
Sample

241101-fkyzaavphv
MD5

6a62fafe2fe649995eea882c9d7c2af2
SHA1

b18693997ac890f611d37f29039e4a94e2dfee59
SHA256

a217006225f74ea5eaf76a0adcc006fd72b7a8a2a408b3f9f0ea370d1dc319b9
SHA512

46f793f79f739612dfe8cd2b344ee443079e7ffdf5c5a5a1989b8f6edb01897d8b83634bc58e56487e48406507dfc316339e98a366739c612d8ec49ff84195b8
SSDEEP

12288:1qr0a9DrRUt89dkZfsod7W+ym18I8VRiw:8HNry3fsozpyVn

Score

10^/10

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

23.227.202.197:2404

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-QPTXAI
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Targets

- Target
  
  PO-33463334788.exe
- Size
  
  511KB
- MD5
  
  77a1c8918ae7893671d3dfe3b410a107
- SHA1
  
  c863d6378582314b9898054031b0eb7019cff637
- SHA256
  
  f091affa4bfe7b5d24c784295f49ce788032b3dd89b0160e95caca1d08f92768
- SHA512
  
  341f7d0749886c8b9efc4e3a2ec2f99bee712418a338a22261fd20d688ddc327cd80754ca36d5f640395cd87c58624b525b3341ac1beab445f45c6d57f1f27b3
- SSDEEP
  
  12288:QXbtieDFJ/9GGYLtORcN1zk2Mt4yGOup8WWfL8s:QXxpDFJ/99Y/WKVbs
Score

10^/10

discovery remcos remotehost collection rat spyware stealer
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Remcos family
  remcos
- Detected Nirsoft tools
  Free utilities often used by attackers which can steal passwords, product keys, etc.
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook accounts
  collection
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  12KB
- MD5
  
  192639861e3dc2dc5c08bb8f8c7260d5
- SHA1
  
  58d30e460609e22fa0098bc27d928b689ef9af78
- SHA256
  
  23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
- SHA512
  
  6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc
- SSDEEP
  
  192:ljHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZqE0QPi:R/Qlt7wiij/lMRv/9V4bfr
Score

3^/10

discovery
behavioral3 behavioral4