remcos

General

Target

f1d5a4cfef77c5b7477f9102e24726ff.XZ
Size

3.3MB
Sample

241203-z8k7wazqgj
MD5

f1d5a4cfef77c5b7477f9102e24726ff
SHA1

9c798a987047d0ffde71f2d046ae605d5b396394
SHA256

2102db2d82f0f80f280e374cb3309221d6a81878929b504ca6c7045ec195d040
SHA512

fcb3ef5b8cdcc8182a78f36dc24f011f00282ad19ffb16b82f6e7476b0807c34c4e567a1c3b62fc6add23039b7c1e96bf9c372a6d7ee4cf1d6cfba10fb66cfe9
SSDEEP

49152:K/Eu4NLyrKUcNZdN9af3wCvyQNfWlHwFEjsMwbKosbidCd9u8w8WKVQPAoHa3+cA:K/Euc7dN9aqCW6Fuqt5dCh/WXIub

Score

10^/10

Malware Config

Extracted

Family

remcos

Botnet

GUS

C2

mastergusta.kozow.com:5151

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-6Q2P7E
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Targets

- Target
  
  DEMANDA LABORAL POR ABUSO DE CONFIANZA 01/01 DEMANDA LABORAL POR ABUSO DE CONFIANZA 165165.exe
- Size
  
  2.3MB
- MD5
  
  5013571e104d9dd42ca2d94e81e430f8
- SHA1
  
  0e0e2b2f1688b77ebea638aa2e12f6462722fcb0
- SHA256
  
  9783cdd475c54ec21a035b5035c80329fa14be830c71c7c133de06ed98ad86d8
- SHA512
  
  c2a4fbb1231cb15fbe3a733c5477d7d0e95ae15cf9a5c7d53eeb452d6b5212a24754d596b90715cead5ae825c989afcacf14c33c1fd363a95cb86a0bc65f932e
- SSDEEP
  
  24576:oKkVrHgHx4mYlt+e5N2lWByqwSFg9NJo7thp9clBb2:Huri4LltP5NSn9NJIclBC
Score

10^/10

remcos gus discovery rat
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Remcos family
  remcos
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2
- Target
  
  DEMANDA LABORAL POR ABUSO DE CONFIANZA 01/WINMM.dll
- Size
  
  5.0MB
- MD5
  
  c1e4443c640d1dc0b408356a0ef216be
- SHA1
  
  9ca2853691bf347e12e620dadcf6ea1cceb817fe
- SHA256
  
  812e1927550e39501b2477df2479dc239b428d11bbae81e719c220769ccd7b34
- SHA512
  
  2d47e620c46634519a861b68ac779e22a910b1f3495d5fb8a3fbad43601bc430a13e538d571192c6aaae83fda2d0c1607901aa7a360bea18da732d1bf81b86c3
- SSDEEP
  
  98304:3yhaH4iFZp4lHd4iQfJuI5Tf4rYfthIfsuspcZpccVHu2S5nneBOc7uZ:3dH4i6l2wWFhnbi/HuveB
Score

10^/10

remcos gus discovery rat
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Remcos family
  remcos
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral3 behavioral4