remcos

General

Target

seemybesttimeforgivenmebestthingswithentiretimeforgivenmegreat.hta
Size

207KB
Sample

241112-lpp5tsynbz
MD5

a9cf15c4f82d5c26f48f4a16dfe7bd1a
SHA1

f7f0b669264b0a42b290cb5476e21ffa51eebf34
SHA256

ff98902753abefb76884fc6fa5fa34f389b215ad9a447bf434624f097f12ad57
SHA512

5a5f5e6d18a776646328ce85e59f12424f1fb8c2612d1299db7bc378177be369bb6e391488b02d40a682c37857bcf0576d415534c5aba4796f46c39ea5b21d2c
SSDEEP

48:4FhWsTR/F7gNqXfkz0eZC0yZhboWWCRzESPUJ0cv5p299DdCf+xuj9AoapwSI0t7:43F97AIyCRRtnu4fAf+cZAoaDna8YQ

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://1017.filemail.com/api/file/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f

exe.dropper

https://1017.filemail.com/api/file/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f

Extracted

Family

remcos

Botnet

RemoteHost

C2

wayo.duckdns.org:6847

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-Z90JT3
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Targets

- Target
  
  seemybesttimeforgivenmebestthingswithentiretimeforgivenmegreat.hta
- Size
  
  207KB
- MD5
  
  a9cf15c4f82d5c26f48f4a16dfe7bd1a
- SHA1
  
  f7f0b669264b0a42b290cb5476e21ffa51eebf34
- SHA256
  
  ff98902753abefb76884fc6fa5fa34f389b215ad9a447bf434624f097f12ad57
- SHA512
  
  5a5f5e6d18a776646328ce85e59f12424f1fb8c2612d1299db7bc378177be369bb6e391488b02d40a682c37857bcf0576d415534c5aba4796f46c39ea5b21d2c
- SSDEEP
  
  48:4FhWsTR/F7gNqXfkz0eZC0yZhboWWCRzESPUJ0cv5p299DdCf+xuj9AoapwSI0t7:43F97AIyCRRtnu4fAf+cZAoaDna8YQ
Score

10^/10

defense_evasion discovery execution remcos remotehost collection rat
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Remcos family
  remcos
- Detected Nirsoft tools
  Free utilities often used by attackers which can steal passwords, product keys, etc.
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Evasion via Device Credential Deployment
  defense_evasion execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Accesses Microsoft Outlook accounts
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2