Overview

overview

10

Static

static

3

093421~1.exe

windows10-2004-x64

10

093421~1.exe

windows11-21h2-x64

10

Resubmissions

16/02/2026, 12:01

260216-n62ajadv2b10

16/02/2026, 11:45

260216-nwt4gads2b10

Sharing

Copy URL Twitter E-mail

General

  • Target
    093421~1.EXE
  • Size 3.9MB
  • Sample260216-n62ajadv2b
  • SHA256 2e4f7da403833e22c25e38ebbfba41bd81f1e6a1281ade9c8e0118b56a1fe3e2
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
remcoshost64adwaredefense_evasiondiscoverypersistenceransomwareratspywaretrojan

Malware Config

Extracted

Family

  • remcos

Botnet

  • host64

C2

  • chiwatoken.com:8279

  • chiwatoken.com:6230

  • 172.94.9.74:59887

  • 172.94.9.74:49309

  • shareitdownload.net:80

  • shareitdownload.net:8279

  • 213.177.179.35:8279

  • 213.177.179.35:8080

  • 176.107.176.77:8080

  • 193.22.96.22:8090

  • 212.90.190.137:465

  • 213.239.227.55:80

  • 185.36.191.6:8080

Attributes
  • audio_folder

    MicRecords

  • audio_path

    ApplicationPath

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    true

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    wsus

  • mouse_option

    false

  • mutex

    Rmc-8SYBJO

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target
      093421~1.EXE
    • Size 3.9MB
    • SHA256 2e4f7da403833e22c25e38ebbfba41bd81f1e6a1281ade9c8e0118b56a1fe3e2
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    adwarehost64defense_evasiondiscoveryremcospersistenceratspywaretrojanransomware

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Remcos family

      remcos

    • UAC bypass

      defense_evasiontrojan

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Impair Defenses

1
T1562

Disable or Modify Tools

1
T1562.001

Modify Registry

5
T1112

Credential Access

Discovery

Browser Information Discovery

1
T1217

Peripheral Device Discovery

2
T1120

Query Registry

6
T1012

System Information Discovery

6
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Time Discovery

1
T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks