remcos | dec26f7cc646acdff30d90fae8837623c70870ed0cc9020930f95b53b6b730db | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

5

dec26f7cc6...db.exe

windows7-x64

dec26f7cc6...db.exe

windows10-2004-x64

Sharing

General

Target

dec26f7cc646acdff30d90fae8837623c70870ed0cc9020930f95b53b6b730db.exe
Size

1.3MB
Sample

241203-dl4j2sxjf1
MD5

973306ff45c5b4ee7333db7a5ef7a0f9
SHA1

32c7065633f821f72f2c2af4a572414cdd79ea91
SHA256

dec26f7cc646acdff30d90fae8837623c70870ed0cc9020930f95b53b6b730db
SHA512

2d703af64af2c213de8e92ab0fa77d692f55f15c3e85d4f5aa4eb6fc049b2ab36ef8ac7b25a85c06aef8eb22972e5103fb5533288f9f9cccabbbaadebc892540
SSDEEP

24576:ztb20pkaCqT5TBWgNQ7ato13PtKK5QXpdbt86F+LAisTLZ6A:wVg5tQ7at8FFOpXt+LAiY5

Score

10^/10

remcos work discovery rat

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

dec26f7cc646acdff30d90fae8837623c70870ed0cc9020930f95b53b6b730db.exe

Resource

win7-20241023-en

remcos work discovery rat

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral2

Sample

dec26f7cc646acdff30d90fae8837623c70870ed0cc9020930f95b53b6b730db.exe

Resource

win10v2004-20241007-en

remcos work discovery rat

windows10-2004-x64

11 signatures

150 seconds

Malware Config

Extracted

Family

remcos

Botnet

WORK

C2

netflixyoutubebrowser.duckdns.org:34043

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-CDDRK8
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Targets

- Target
  
  dec26f7cc646acdff30d90fae8837623c70870ed0cc9020930f95b53b6b730db.exe
- Size
  
  1.3MB
- MD5
  
  973306ff45c5b4ee7333db7a5ef7a0f9
- SHA1
  
  32c7065633f821f72f2c2af4a572414cdd79ea91
- SHA256
  
  dec26f7cc646acdff30d90fae8837623c70870ed0cc9020930f95b53b6b730db
- SHA512
  
  2d703af64af2c213de8e92ab0fa77d692f55f15c3e85d4f5aa4eb6fc049b2ab36ef8ac7b25a85c06aef8eb22972e5103fb5533288f9f9cccabbbaadebc892540
- SSDEEP
  
  24576:ztb20pkaCqT5TBWgNQ7ato13PtKK5QXpdbt86F+LAisTLZ6A:wVg5tQ7at8FFOpXt+LAiY5
Score

10^/10

remcos work discovery rat
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Remcos family
  remcos
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

remcosworkdiscoveryrat

behavioral2

remcosworkdiscoveryrat

© 2018-2025

Terms | Privacy

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.