remcos

General

Target

mitradesignworkgoodforeveryoneforgiftedmbestthings.hta
Size

207KB
Sample

241113-h931mswqhw
MD5

6e8e497a9ab2be601520a182073419f1
SHA1

1f66efaeed5492931779fa941b1a67967f9c0ee2
SHA256

faae949a7d2f32b0ae09b23d53d602dac380db26541952755c920773e46f8bcd
SHA512

73b1035d2975aea8dc579a307fce7f2c15b1a240063dbfdb5b13e01571a5f188c25dc6f8ad9ed300e87c760ce1a2f0e6098f1cfb199ae03e28e9476766466895
SSDEEP

96:43F97KoUXZbhIoUXZzhoZx79f+hs6oByayqoUXZSoUXZ4hMoUXZrQ:43F1NaZRaZKT9+7CyaytaZVaZ8aZrQ

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://1017.filemail.com/api/file/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f

exe.dropper

https://1017.filemail.com/api/file/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f

Extracted

Family

remcos

Botnet

RemoteHost-16465

C2

rem.aaahorneswll.com:16465

31.13.224.230:16465

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-80V4Z7
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Targets

- Target
  
  mitradesignworkgoodforeveryoneforgiftedmbestthings.hta
- Size
  
  207KB
- MD5
  
  6e8e497a9ab2be601520a182073419f1
- SHA1
  
  1f66efaeed5492931779fa941b1a67967f9c0ee2
- SHA256
  
  faae949a7d2f32b0ae09b23d53d602dac380db26541952755c920773e46f8bcd
- SHA512
  
  73b1035d2975aea8dc579a307fce7f2c15b1a240063dbfdb5b13e01571a5f188c25dc6f8ad9ed300e87c760ce1a2f0e6098f1cfb199ae03e28e9476766466895
- SSDEEP
  
  96:43F97KoUXZbhIoUXZzhoZx79f+hs6oByayqoUXZSoUXZ4hMoUXZrQ:43F1NaZRaZKT9+7CyaytaZVaZ8aZrQ
Score

10^/10

defense_evasion discovery execution remcos remotehost-16465 rat
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Remcos family
  remcos
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Evasion via Device Credential Deployment
  defense_evasion execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext
behavioral1 behavioral2