General
- Target f0ba3c05ef14646474b74b5c93d85edd2e2a9ff07df582bc09ac2c1d0115c7a2.bin
- Size 372KB
- Sample260417-gf2eaabt7t
- SHA256 f0ba3c05ef14646474b74b5c93d85edd2e2a9ff07df582bc09ac2c1d0115c7a2
Score
10/10
Malware Config
Extracted
Family
-
remcos
Version
-
7.2.2 Pro
Botnet
-
RemoteHost
C2
-
192.227.135.240:3000
Attributes
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
true
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-40TJWS
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
- Target Approved bonuses.exe
- Size 719KB
- SHA256 5646873f89e3468c306385ef3d65b7daf63aeee4128553c3224c75cb0e6902ca
Score10/10-
Family: Remcos
Remcos is a closed-source remote control and surveillance software.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Drops file in System32 directory
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 014f1dfeb842cf7265a3644bc6903c592abe9049bfc7396829172d3d72c4d042
Score3/10 -
- Target $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 b2699fdfdab6a018fcc972806d12f71972de1861660bb6578935d62b1da06504
Score3/10