remcos

General

Target

sweetbabygivenbestthignsetnirelifegivenbackbestthignsalways.hta
Size

599KB
Sample

241126-ka6nlazjbm
MD5

5a9dc05899d1a19be638824e5f47b88e
SHA1

418e5c2cfc4ba40069bbcbc7373e9ff0b71740f2
SHA256

741297ecc59d39296f360b100032cdb120af2eb4ccc5b91f370c0eacb9ee7e25
SHA512

0772c9718b79ccff96ed8631ad22d117876c1cb5f1b9313494051e52a63b8f360d8f5fc81beaee296e120a873e99414818bb36db6bf795dfe99d54b3f47f4d7e
SSDEEP

192:4dE6COljVneLyZXcFeLyZXcEeLyZXc/Czt4kQ:b6COljV+zO7

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://3105.filemail.com/api/file/get?filekey=shTPHbCPX8o-lOtCqHLG6_0xCy-xl4tnxlAVbQ95-dviTK5cARaNdQjbb3mexfwQzKmTXg&skipreg=true&pk_vid=e0109638c9bfb9571732531309b5ff7c

exe.dropper

https://3105.filemail.com/api/file/get?filekey=shTPHbCPX8o-lOtCqHLG6_0xCy-xl4tnxlAVbQ95-dviTK5cARaNdQjbb3mexfwQzKmTXg&skipreg=true&pk_vid=e0109638c9bfb9571732531309b5ff7c

Extracted

Family

remcos

Botnet

RemoteHost

C2

nextnewupdationsforu.duckdns.org:14645

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-EC111K
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Targets

- Target
  
  sweetbabygivenbestthignsetnirelifegivenbackbestthignsalways.hta
- Size
  
  599KB
- MD5
  
  5a9dc05899d1a19be638824e5f47b88e
- SHA1
  
  418e5c2cfc4ba40069bbcbc7373e9ff0b71740f2
- SHA256
  
  741297ecc59d39296f360b100032cdb120af2eb4ccc5b91f370c0eacb9ee7e25
- SHA512
  
  0772c9718b79ccff96ed8631ad22d117876c1cb5f1b9313494051e52a63b8f360d8f5fc81beaee296e120a873e99414818bb36db6bf795dfe99d54b3f47f4d7e
- SSDEEP
  
  192:4dE6COljVneLyZXcFeLyZXcEeLyZXc/Czt4kQ:b6COljV+zO7
Score

10^/10

defense_evasion discovery execution remcos remotehost rat
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Remcos family
  remcos
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Evasion via Device Credential Deployment
  defense_evasion execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext
behavioral1 behavioral2