remcos

General

Target

JaffaCakes118_c64ca5606398aa1b9ad898707b9eb52e93868af100fde7df07c649a328f5acb1
Size

167KB
Sample

241230-1nsxnazpeq
MD5

81122436e8f9bee73b42cb340da4ed89
SHA1

5681b8ffe1d833140eb0459dc15439e2ad70bf12
SHA256

c64ca5606398aa1b9ad898707b9eb52e93868af100fde7df07c649a328f5acb1
SHA512

fa8654b35074176aec7ce845d9790bb011feb042c9d4878ef98151b6b0701f6e2c80fd3953b8eefbd84e433ba37566781b3a75e8ec76e0d04b80a4963fafdeef
SSDEEP

3072:3ToY1iLr4+h9lvRD1buXUmLnqqb2cQPCWzwC6Fg8Rcchm+6+v5/cx:DIL59RAXLnqq2P/MFwc96k9cx

Score

10^/10

Malware Config

Extracted

Family

remcos

Version

2.7.2 Pro

Botnet

RemoteHost

C2

103.151.124.64:2243

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
pdf
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
pdf
keylog_path
%AppData%
mouse_option
false
mutex
pdf-TDD0QE
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
pdf
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
wikipedia;solitaire;

Targets

- Target
  
  QUOTATION.exe
- Size
  
  181KB
- MD5
  
  c66292916d227f292cac326f75993383
- SHA1
  
  eef2a4651a5ed35b02860d01e2fb6820d24aa335
- SHA256
  
  94073b5a128209945ad89ec7a8c554d774f11ec2dbad6bbdf9326169e3b56733
- SHA512
  
  d041bfde6dde674f749a55e90d1cef32b419f2a580a6c6a31fea6cffd93825c9148c6dbf709ded5ed7878eec52a813cb12bc8798e5e153df77af4556b4d63b8a
- SSDEEP
  
  3072:IBkfJpRXATwMdFCcibEGLOeBey8VdpDZOYquD8Y8BR0XDkF21EJkrT1FRAHvr1Oq:IqjIOE5SeyEb1vq7YmR0XFxKhOSt
Score

10^/10

remcos remotehost discovery persistence rat
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Remcos family
  remcos
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  11KB
- MD5
  
  fccff8cb7a1067e23fd2e2b63971a8e1
- SHA1
  
  30e2a9e137c1223a78a0f7b0bf96a1c361976d91
- SHA256
  
  6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e
- SHA512
  
  f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c
- SSDEEP
  
  192:xPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4v:g7VpNo8gmOyRsVc4
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  
  8b1h6puq1on44ey.dll
- Size
  
  13KB
- MD5
  
  7ecdcf1bffe6d1438e48f55ad0189544
- SHA1
  
  cadfac118ce47c345bcf3bd22a695a5e4bf172ad
- SHA256
  
  3a923a9fef243b18f8f68795ddcaa16416f5c4f811361947f8e6bb1b22f36aa3
- SHA512
  
  68c52981838618344be4cac12d0fe4e3f21c58e498a3f245de3622dd9a6c15c733de2da4116f3daff6558f3b45df9b7d88e6cc58159c24f178882d909bc83912
- SSDEEP
  
  192:I0g35dcYWK+a/n0UcqktGOU4uWlkk7dXgxv+JBJ5FOKnLMHSOBG87IQfM:8dcY7ZwfWWlk6XgEJBJ554FGvQfM
Score

6^/10

discovery persistence
- Adds Run key to start application
  persistence
behavioral5 behavioral6