remcos

General

Target

ce.vbs
Size

12KB
Sample

241120-hptlgasgpa
MD5

24a5eb1c1b75ab29f6c090f1038c3835
SHA1

edf754d24c9203b1ef43cc4b2493b6fd13b5b818
SHA256

20df5a030d038d90d345e184bb5413aeeb38cf1be522099ac4ea376c31195974
SHA512

fa101576f48116a45dd03fb4938023f3542b077492d0d1ff395a9f829c4b78ecaff247ad01ebb0769712057b620e6e9f853e2b11bd3a5d97fb0406a9239f5290
SSDEEP

192:PyUrlOx2qeAQm1CcUWgeAQZeyjzp+UhSAGGuGHRkfko:KURb3ODPwUgAuGHRk8o

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://1017.filemail.com/api/file/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f

exe.dropper

https://1017.filemail.com/api/file/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f

Extracted

Family

remcos

Botnet

cee

C2

cee.work.gd:2531

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
vlc
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
ios
mouse_option
false
mutex
gig-1IH5DX
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
sos
take_screenshot_option
false
take_screenshot_time
5

Targets

- Target
  
  ce.vbs
- Size
  
  12KB
- MD5
  
  24a5eb1c1b75ab29f6c090f1038c3835
- SHA1
  
  edf754d24c9203b1ef43cc4b2493b6fd13b5b818
- SHA256
  
  20df5a030d038d90d345e184bb5413aeeb38cf1be522099ac4ea376c31195974
- SHA512
  
  fa101576f48116a45dd03fb4938023f3542b077492d0d1ff395a9f829c4b78ecaff247ad01ebb0769712057b620e6e9f853e2b11bd3a5d97fb0406a9239f5290
- SSDEEP
  
  192:PyUrlOx2qeAQm1CcUWgeAQZeyjzp+UhSAGGuGHRkfko:KURb3ODPwUgAuGHRk8o
Score

10^/10

discovery execution remcos cee rat
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Remcos family
  remcos
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Suspicious use of SetThreadContext
behavioral1 behavioral2