remcos

General

Target

segura.vbs
Size

137KB
Sample

241125-h11h6a1lgj
MD5

35bd12d3b3ad8f5c44f9f30e9d1ac1ca
SHA1

210686e9d8d1ad87d7df73df220f82e2cfc61bb0
SHA256

96c1dbdae1cced29559e795132482e8f2fc900e2699e4f3690833ff6f1bba359
SHA512

48582c3f2c47376a2b6a7adce346fbc733fbd91396bcdbf3193dd913202298e2dccb80ae0044ca356bcddfdce2856170d5f26b82e2e6e7cf6e7398721b9dd33a
SSDEEP

3072:NJbn4ermx9Nni6AbY03G/n8irzgt5pUGwm:flQNuc0W/4

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://1017.filemail.com/api/file/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f

exe.dropper

https://1017.filemail.com/api/file/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f

Extracted

Family

remcos

Botnet

Nt

C2

fenixinria.duckdns.org:2404

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-LXSJK6
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Targets

- Target
  
  segura.vbs
- Size
  
  137KB
- MD5
  
  35bd12d3b3ad8f5c44f9f30e9d1ac1ca
- SHA1
  
  210686e9d8d1ad87d7df73df220f82e2cfc61bb0
- SHA256
  
  96c1dbdae1cced29559e795132482e8f2fc900e2699e4f3690833ff6f1bba359
- SHA512
  
  48582c3f2c47376a2b6a7adce346fbc733fbd91396bcdbf3193dd913202298e2dccb80ae0044ca356bcddfdce2856170d5f26b82e2e6e7cf6e7398721b9dd33a
- SSDEEP
  
  3072:NJbn4ermx9Nni6AbY03G/n8irzgt5pUGwm:flQNuc0W/4
Score

10^/10

execution remcos nt discovery rat
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Remcos family
  remcos
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext
behavioral1 behavioral2