remcos

General

Target

365695a8882615e0e1f85b8477bb82212783b1ef3672f67a8ca92bc252ec11ed.exe
Size

1.9MB
Sample

250128-qg8z7asncn
MD5

9c14de2917293f81b23b0cde00ddc624
SHA1

0baa9c81a415a4d4d72305f71490ca32816c63a1
SHA256

365695a8882615e0e1f85b8477bb82212783b1ef3672f67a8ca92bc252ec11ed
SHA512

c4145d85bbe7b5414009ebfe2a04242d872623c5133f4e5da9fe8c27b0742349e51d80434ed1abceda4ed21776d37437fc39d74c67abd5daf4f546e2c98e29cb
SSDEEP

49152:kDjlabwz9E7lIyIp6GVn+8OzCHGV4wUhCDOs:0qw8lIyIpd+8wlUrs

Score

10^/10

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

185.42.12.75:2406

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
010325
keylog_path
%AppData%
mouse_option
false
mutex
010325-YWFFXL
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Targets

- Target
  
  365695a8882615e0e1f85b8477bb82212783b1ef3672f67a8ca92bc252ec11ed.exe
- Size
  
  1.9MB
- MD5
  
  9c14de2917293f81b23b0cde00ddc624
- SHA1
  
  0baa9c81a415a4d4d72305f71490ca32816c63a1
- SHA256
  
  365695a8882615e0e1f85b8477bb82212783b1ef3672f67a8ca92bc252ec11ed
- SHA512
  
  c4145d85bbe7b5414009ebfe2a04242d872623c5133f4e5da9fe8c27b0742349e51d80434ed1abceda4ed21776d37437fc39d74c67abd5daf4f546e2c98e29cb
- SSDEEP
  
  49152:kDjlabwz9E7lIyIp6GVn+8OzCHGV4wUhCDOs:0qw8lIyIpd+8wlUrs
Score

10^/10

remcos remotehost discovery rat
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Remcos family
  remcos
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Remcos family

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

We care about your privacy.