remcos | 604d39766391d9e7f14ff6a41ad53f97dd011a9de075505f215170dfe1768d6e

General

Target
x604d39766391d9e7f14ff6a41ad53f97dd011a9de075505f215170dfe1768d6e.exe
Size 626KB
Sample260415-v411baft7l
SHA256 604d39766391d9e7f14ff6a41ad53f97dd011a9de075505f215170dfe1768d6e
MD5 aa99ebe812c38cc791c050298626923a
SHA1 99a46a6661bb3a443bbf84db732990dcfaea7b58
SHA512 d0c188c7a6d1d787fdaa6a53fb6ed709a7e18f36c95e379985ec2aaafff7fc09ad17e04015100298da0d25509832f258845aaa143e855cd2e541a186bdf3b31f
SSDEEP 12288:zYC6phcxu+g2yjk91gBoU1Pn1CECdtd19hrsAj+qsASeer5+nZoE:zYZpmO2yjk9aBRfzCfd1frKNuT
TLSH
T1F5D4011EB6A9FAD7C9724F302C74865467B2B89369501A3B1AD0530E6C271F4CE2BF35
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

remcos

Version

4.7.2 Pro

Botnet

RemoteHost

C2

208.67.107.123:8780

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-1ZDEV4
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Targets

- Target
  x604d39766391d9e7f14ff6a41ad53f97dd011a9de075505f215170dfe1768d6e.exe
- Size 626KB
- SHA256 604d39766391d9e7f14ff6a41ad53f97dd011a9de075505f215170dfe1768d6e
- MD5 aa99ebe812c38cc791c050298626923a
- SHA1 99a46a6661bb3a443bbf84db732990dcfaea7b58
- SHA512 d0c188c7a6d1d787fdaa6a53fb6ed709a7e18f36c95e379985ec2aaafff7fc09ad17e04015100298da0d25509832f258845aaa143e855cd2e541a186bdf3b31f
- SSDEEP 12288:zYC6phcxu+g2yjk91gBoU1Pn1CECdtd19hrsAj+qsASeer5+nZoE:zYZpmO2yjk9aBRfzCfd1frKNuT
- TLSH
  T1F5D4011EB6A9FAD7C9724F302C74865467B2B89369501A3B1AD0530E6C271F4CE2BF35
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2
- Target
  $PLUGINSDIR/blvitae.dll
- Size 83KB
- SHA256 82f3d8e31e90e0250657e38806cff749e68a40676bee6883d9af5e056303c532
- MD5 ac6721f85992ebcd8f880fa231f056d4
- SHA1 88c553a0cc6504de31fcd17efe03ecbc62d7f94e
- SHA512 a1b9c5225397a84d06ba21585f4e9075bef35703e8d3a67bbcd621277cd235263aae86ef7e4081fcc0bef3899e807b577ad828f4b34b41eb4800c241749b3d87
- SSDEEP 1536:pHCa7j/RLmHWR2LTujFWIci/Zt21sWv9cd5kTSvmxOvNR:84RLmHFLTujF7v2Xs5kuOxOvNR
- TLSH
  T1AA835B4075D1C871E6BE09355864D5616B3EBD528FE09E6B278623AE0F702C1EF34E3A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

remotehost discovery remcos persistence rat
- Family: Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral3 behavioral4