remcos

General

Target

134d52fbb53944f8d09eb33663c83f406e5fa15996afe1bb7e95eeef99298821.hta
Size

281KB
Sample

241112-chm78ascpf
MD5

b36b8c1d87172cd3d7646f53a58d4936
SHA1

f816a31bcb508052f54fa572eddf2e84ed7eef0c
SHA256

134d52fbb53944f8d09eb33663c83f406e5fa15996afe1bb7e95eeef99298821
SHA512

188c4f4b2a3e8659edf4fb88dd8cea3d91c3a44caa5b9350705393b65272538b63b581f6a044b2d24f74b1ba42cd2f9328e5253a690182235b093cd7ee57bf8e
SSDEEP

48:4FhWsTROELdn97g5un7MqnQKb4VwoIADQKp4VwoIA8S29++RWPi+8d6Ba5L1nNQk:43FZ97HnQ8iQsrkV8d6Ba1jQtQsMpQpQ

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://1017.filemail.com/api/file/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f

exe.dropper

https://1017.filemail.com/api/file/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f

Extracted

Family

remcos

Botnet

RemoteHost

C2

shlobo.duckdns.org:9687

shlobo.duckdns.org:9374

shlobo.duckdns.org:8764

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-U2TQ1C
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Targets

- Target
  
  134d52fbb53944f8d09eb33663c83f406e5fa15996afe1bb7e95eeef99298821.hta
- Size
  
  281KB
- MD5
  
  b36b8c1d87172cd3d7646f53a58d4936
- SHA1
  
  f816a31bcb508052f54fa572eddf2e84ed7eef0c
- SHA256
  
  134d52fbb53944f8d09eb33663c83f406e5fa15996afe1bb7e95eeef99298821
- SHA512
  
  188c4f4b2a3e8659edf4fb88dd8cea3d91c3a44caa5b9350705393b65272538b63b581f6a044b2d24f74b1ba42cd2f9328e5253a690182235b093cd7ee57bf8e
- SSDEEP
  
  48:4FhWsTROELdn97g5un7MqnQKb4VwoIADQKp4VwoIA8S29++RWPi+8d6Ba5L1nNQk:43FZ97HnQ8iQsrkV8d6Ba1jQtQsMpQpQ
Score

10^/10

defense_evasion discovery execution remcos remotehost rat
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Remcos family
  remcos
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Evasion via Device Credential Deployment
  defense_evasion execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext
behavioral1 behavioral2