remcos

General

Target

createdbestthignswihtentiretimegivenmebestforever.tIF
Size

150KB
Sample

241128-jg1kgswpgr
MD5

3703614d7a8cee78abec953fcb0971b6
SHA1

8bf58afd59612f71f4d767f402f166122a4b3470
SHA256

9c4b12f92fbde8c79f404703fe07576dc3b9a1a30052251e59dbc5d547dffc93
SHA512

25493a97a739389b11014bcb5d0c5a8c0cdc178e62594582c40ab13acf1654713108c75d9273172f7883dcc19e27ffe9803ea818e0c3ef3546a17d5e6a45bf02
SSDEEP

3072:OSkcclGF+6kr/vfxM1MheSkcclGF+6kr/vfxM1MheSkcclGF+6kr/vfxM1Mh6:FkoF+7fx8MnkoF+7fx8MTkoF+7fx8MI

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://3012.filemail.com/api/file/get?filekey=OF0gFcxMQCUwPYleTyb2Yh9aBTpRl9_K_LOoTKArK4ipMrH8N0jibXrPYJoFvjqaK50qGw&track=krUNywEJ&skipreg=true&pk_vid=a6a926643893714e17327089141d9432

exe.dropper

https://3012.filemail.com/api/file/get?filekey=OF0gFcxMQCUwPYleTyb2Yh9aBTpRl9_K_LOoTKArK4ipMrH8N0jibXrPYJoFvjqaK50qGw&track=krUNywEJ&skipreg=true&pk_vid=a6a926643893714e17327089141d9432

Extracted

Family

remcos

Botnet

RemoteHost

C2

newbeggin.duckdns.org:2431

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-8FCP5S
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Targets

- Target
  
  createdbestthignswihtentiretimegivenmebestforever.tIF
- Size
  
  150KB
- MD5
  
  3703614d7a8cee78abec953fcb0971b6
- SHA1
  
  8bf58afd59612f71f4d767f402f166122a4b3470
- SHA256
  
  9c4b12f92fbde8c79f404703fe07576dc3b9a1a30052251e59dbc5d547dffc93
- SHA512
  
  25493a97a739389b11014bcb5d0c5a8c0cdc178e62594582c40ab13acf1654713108c75d9273172f7883dcc19e27ffe9803ea818e0c3ef3546a17d5e6a45bf02
- SSDEEP
  
  3072:OSkcclGF+6kr/vfxM1MheSkcclGF+6kr/vfxM1MheSkcclGF+6kr/vfxM1Mh6:FkoF+7fx8MnkoF+7fx8MTkoF+7fx8MI
Score

10^/10

execution remcos remotehost collection discovery rat
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Remcos family
  remcos
- Detected Nirsoft tools
  Free utilities often used by attackers which can steal passwords, product keys, etc.
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Blocklisted process makes network request
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Accesses Microsoft Outlook accounts
  collection
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Suspicious use of SetThreadContext
behavioral1 behavioral2