remcos

General

Target

chakarathingsaregreatpatternwelcomebacktotherealworldbaby.hta
Size

207KB
Sample

241114-ltws6s1kbp
MD5

9da35c0fa320e4c71bcda752eb4b9cf1
SHA1

1b6b928a3451f86debea42164de4ba8ceceb1fd6
SHA256

819ec71dfdacd69c6fc2c7b495029f637d21018bbd0fcce8af229308bc647043
SHA512

2f1b7631c33838ec2108e0de7e9b4a20d6090b482b8b4a802507387a449d7321447cf7a0a077f5635f2c80ccaa80e68f9762690da2f7c58f6e8932d3b341126c
SSDEEP

96:43F97AobVwb/tbVwbBFLIJd2fqsOSvWn/fn/CAbVwbNbVwbPTbVwbd/Q:43F1JG+LO2aiWn/fn/xq28Q

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://1017.filemail.com/api/file/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f

exe.dropper

https://1017.filemail.com/api/file/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f

Extracted

Family

remcos

Botnet

RemoteHost

C2

shlobo.duckdns.org:6946

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-MTESOL
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Targets

- Target
  
  chakarathingsaregreatpatternwelcomebacktotherealworldbaby.hta
- Size
  
  207KB
- MD5
  
  9da35c0fa320e4c71bcda752eb4b9cf1
- SHA1
  
  1b6b928a3451f86debea42164de4ba8ceceb1fd6
- SHA256
  
  819ec71dfdacd69c6fc2c7b495029f637d21018bbd0fcce8af229308bc647043
- SHA512
  
  2f1b7631c33838ec2108e0de7e9b4a20d6090b482b8b4a802507387a449d7321447cf7a0a077f5635f2c80ccaa80e68f9762690da2f7c58f6e8932d3b341126c
- SSDEEP
  
  96:43F97AobVwb/tbVwbBFLIJd2fqsOSvWn/fn/CAbVwbNbVwbPTbVwbd/Q:43F1JG+LO2aiWn/fn/xq28Q
Score

10^/10

defense_evasion discovery execution remcos remotehost rat
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Remcos family
  remcos
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Evasion via Device Credential Deployment
  defense_evasion execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext
behavioral1 behavioral2