remcos | xfb481ab52dc34d0284b1385d40b048c342ffc73b59ed553cf768922382fcfa48[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
xfb481ab52dc34d0284b1385d40b048c342ffc73b59ed553cf768922382fcfa48.exe
Size 7.5MB
Sample260427-srvxesht2q
SHA256 fb481ab52dc34d0284b1385d40b048c342ffc73b59ed553cf768922382fcfa48
MD5 d17f2234de244b858a3b6797c374b9b8
SHA1 06683fbf28ee027ea739eeb03af7e57c0a23c2d6
SHA512 d3945dc91375e3831a878568488278b965f5626344c70c834063a2938100dfc720376624ad3532891909d1b0ba7016037af33af2210a8111b5abc06e1edd8025
SSDEEP 98304:QNUJbnLrHp/qKm2/Sb/gqAZj+UzKb3HtFPYjqVqu:DHrRb/G8+HOqMu
TLSH
T1A5764913FBC11CE6F24931779B540601D329EC6592AB1361316C225BDF9F783AF2A62B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

new rat remcos

Malware Config

Extracted

Family

remcos

Version

3.2.0 Pro

Botnet

46.8.211.72:4444

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
svchost.exe
copy_folder
svchost
delete_file
true
hide_file
true
hide_keylog_file
false
install_flag
true
install_path
%WinDir%\System32
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-3B70IW
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
svchost
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
notepad;solitaire;

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
xfb481ab52dc34d0284b1385d40b048c342ffc73b59ed553cf768922382fcfa48.exe

File Explorer

xfb481ab52dc34d0284b1385d40b048c342ffc73b59ed553cf768922382fcfa48.exe

.exe 7.5MB

xfb481ab52dc34d0284b1385d40b048c342ffc73b59ed553cf768922382fcfa48.exe

IMPHASH ec8ea73e2aa6f868311acc5b792bc222
SHA256 fb481ab52dc34d0284b1385d40b048c342ffc73b59ed553cf768922382fcfa48
MD5 d17f2234de244b858a3b6797c374b9b8
SHA1 06683fbf28ee027ea739eeb03af7e57c0a23c2d6
SHA512 d3945dc91375e3831a878568488278b965f5626344c70c834063a2938100dfc720376624ad3532891909d1b0ba7016037af33af2210a8111b5abc06e1edd8025
SSDEEP 98304:QNUJbnLrHp/qKm2/Sb/gqAZj+UzKb3HtFPYjqVqu:DHrRb/G8+HOqMu
TLSH
T1A5764913FBC11CE6F24931779B540601D329EC6592AB1361316C225BDF9F783AF2A62B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

194412

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CreateToolhelp32Snapshot OpenMutexA Process32NextW LoadLibraryA Process32FirstW GetProcAddress VirtualProtect SetLastError VirtualFree VirtualAlloc GetNativeSystemInfo HeapAlloc GetProcessHeap FreeLibrary IsBadReadPtr GetTempPathW OpenProcess lstrcatW GetCurrentProcessId GetTempFileNameW GetCurrentProcess GlobalAlloc GlobalLock GetTickCount GlobalUnlock WriteProcessMemory ResumeThread GetThreadContext VirtualAllocEx ReadProcessMemory CreateProcessW SetThreadContext LocalAlloc GlobalFree MulDiv SizeofResource GetLongPathNameW SetFilePointer FindResourceA LockResource LoadResource GetModuleFileNameA lstrcpynA AllocConsole QueryPerformanceFrequency QueryPerformanceCounter GetLocaleInfoA LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection HeapSize WriteConsoleW SetStdHandle SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExA ReadConsoleW GetConsoleMode GetConsoleCP FlushFileBuffers GetFileType GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW HeapReAlloc GetACP GetStdHandle GetModuleHandleExW MoveFileExW RtlUnwind RaiseException LoadLibraryExW GetCPInfo GetStringTypeW GetLocaleInfoW LCMapStringW CompareStringW TlsFree TlsSetValue CreateMutexA CopyFileW DeleteFileA ExpandEnvironmentStringsA FindNextFileA FindFirstFileA CreateDirectoryW GetFileSize TerminateThread GetLastError SetFileAttributesW GetModuleHandleA RemoveDirectoryW FindClose MoveFileW SetFilePointerEx GetLogicalDriveStringsA DeleteFileW GetFileAttributesW lstrlenA GetDriveTypeA FindNextFileW GetFileSizeEx FindFirstFileW ExitProcess CreateProcessA PeekNamedPipe CreatePipe TerminateProcess ReadFile HeapFree HeapCreate CreateEventA GetLocalTime CreateThread SetEvent WaitForSingleObject Sleep GetModuleFileNameW CloseHandle ExitThread CreateFileW WriteFile EnterCriticalSection TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount MultiByteToWideChar DecodePointer EncodePointer WideCharToMultiByte InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent GetModuleHandleW CreateEventW WaitForSingleObjectEx ResetEvent SetEndOfFile

user32

SetForegroundWindow TranslateMessage DispatchMessageA GetMessageA GetWindowTextW wsprintfW GetClipboardData UnhookWindowsHookEx GetForegroundWindow ToUnicodeEx GetKeyboardLayout SetWindowsHookExA CloseClipboard GetWindowThreadProcessId GetKeyboardState CallNextHookEx SetClipboardData EnumWindows ExitWindowsEx EmptyClipboard ShowWindow SetWindowTextW MessageBoxW IsWindowVisible CloseWindow SendInput mouse_event GetWindowTextLengthW GetKeyState OpenClipboard TrackPopupMenu DrawIcon GetSystemMetrics GetIconInfo SystemParametersInfoW CreatePopupMenu GetCursorPos DefWindowProcA CreateWindowExA AppendMenuA RegisterClassExA GetKeyboardLayoutNameA

gdi32

CreateCompatibleBitmap SelectObject StretchBlt GetDIBits DeleteDC DeleteObject CreateDCA GetObjectA CreateCompatibleDC

advapi32

CryptAcquireContextA CryptGenRandom CryptReleaseContext GetUserNameW RegEnumKeyExA QueryServiceStatus CloseServiceHandle OpenSCManagerW OpenSCManagerA ControlService StartServiceW QueryServiceConfigW ChangeServiceConfigW OpenServiceW EnumServicesStatusW AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken RegCreateKeyA RegCloseKey RegQueryInfoKeyW RegQueryValueExA RegCreateKeyExW RegEnumKeyExW RegSetValueExW RegSetValueExA RegOpenKeyExA RegOpenKeyExW RegCreateKeyW RegDeleteValueW RegEnumValueW RegQueryValueExW RegDeleteKeyA

shell32

ShellExecuteW ShellExecuteExA Shell_NotifyIconA ExtractIconA

shlwapi

StrToIntA PathFileExistsA PathFileExistsW

winmm

PlaySoundW mciSendStringA mciSendStringW waveInClose waveInAddBuffer waveInStart waveInOpen waveInUnprepareHeader waveInPrepareHeader waveInStop

ws2_32

closesocket WSAStartup send socket connect WSAGetLastError gethostbyname htons inet_ntoa recv

urlmon

URLDownloadToFileW URLOpenBlockingStreamW

gdiplus

GdiplusStartup GdipGetImageEncoders GdipCloneImage GdipAlloc GdipDisposeImage GdipFree GdipGetImageEncodersSize GdipSaveImageToStream GdipSaveImageToFile GdipLoadImageFromStream

Name

.text

Size

326KB

Virtual Size

326KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

92KB

Virtual Size

91KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

1024B

Virtual Size

560B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

RBlfxoss

Size

1024B

Virtual Size

791B

Characteristics

Name

ulgmenbE

Size

4KB

Virtual Size

3KB

Characteristics

Name

YzZHzWyw

Size

2KB

Virtual Size

1KB

Characteristics

Name

FhzgPEZI

Size

18KB

Virtual Size

18KB

Characteristics

Name

pKoauZJW

Size

6.8MB

Virtual Size

6.8MB

Characteristics

Name

MYITyacJ

Size

17KB

Virtual Size

16KB

Characteristics

Name

aLDMLMaP

Size

1024B

Virtual Size

722B

Characteristics

Name

sqxdvVUJ

Size

87KB

Virtual Size

87KB

Characteristics

Name

Mmfgkuhm

Size

2KB

Virtual Size

1KB

Characteristics

Name

JmQcrPIB

Size

66KB

Virtual Size

66KB

Characteristics

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

xfb481ab52dc34d0284b1385d40b048c342ffc73b59ed553cf768922382fcfa48.exe

kernel32

user32

gdi32

advapi32

shell32

shlwapi

winmm

ws2_32

urlmon

gdiplus

generic