remcos | 6693687ad7b7f215425bf090a41caa8031532d5640fba95ee5b6a083d07ddbce

Resubmissions

27/06/2026, 12:09

260627-pbphxsa19r10

27/06/2026, 12:08

260627-pa2rvsas9z10

27/06/2026, 11:54

260627-n3a9yaa16j10

Sharing

Copy URL Twitter E-mail

General

Target
Project Ultimate.zip
Size 5.9MB
Sample260627-pbphxsa19r
SHA256 6693687ad7b7f215425bf090a41caa8031532d5640fba95ee5b6a083d07ddbce
MD5 a6d3023e48684c102be4a836b9075ae4
SHA1 de21abd21a5792f796e982fe894adcb050bcba2c
SHA512 7224a18459fd2ee32a227e5267f5276c6c6aac660f331c667ccc126751759fea45ad45b06c215e28b6d7726f1f3403b0d439799908de0c83bc1a8407960313f2
SSDEEP 98304:tGtc5FcrhJ/660+5ywXXkQ7xPOCYJEflEW5y02YwRnFY2YwRnFY1Zm:IhL5yAkQ7xP7xlEW5y0rsOrs63m
TLSH
T13856333F12608ADBCEDC71795E0AAACCA3DEF74085F309D32E071BA1326E755D59A901
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

remcos

Version

3.8.0 Pro

Botnet

RemoteHost

90.242.163.41:2404

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
RuntimeBroker.exe
delete_file
false
hide_file
false
hide_keylog_file
true
install_flag
true
install_path
%WinDir%\System32
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
Log
keylog_path
%Temp%
mouse_option
false
mutex
Rmc-YJVD2X
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Targets

- Target
  Project Ultimate.zip
- Size 5.9MB
- SHA256 6693687ad7b7f215425bf090a41caa8031532d5640fba95ee5b6a083d07ddbce
- MD5 a6d3023e48684c102be4a836b9075ae4
- SHA1 de21abd21a5792f796e982fe894adcb050bcba2c
- SHA512 7224a18459fd2ee32a227e5267f5276c6c6aac660f331c667ccc126751759fea45ad45b06c215e28b6d7726f1f3403b0d439799908de0c83bc1a8407960313f2
- SSDEEP 98304:tGtc5FcrhJ/660+5ywXXkQ7xPOCYJEflEW5y02YwRnFY2YwRnFY1Zm:IhL5yAkQ7xP7xlEW5y0rsOrs63m
- TLSH
  T13856333F12608ADBCEDC71795E0AAACCA3DEF74085F309D32E071BA1326E755D59A901
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery persistence ransomware
behavioral1 behavioral2
- Target
  Project Ultimate/Bin/Quorum.dll
- Size 2.1MB
- SHA256 4befac1dc4116ddbd1b43a3b589aaf9ca1c9330c6ad36b72c7c3abdb686f959b
- MD5 d00c6e885cbb0e6171005901dbb213b5
- SHA1 62d0c135916e56ed38d455021660cc2a6f464c66
- SHA512 9b06f1e60da56fde5f917ae7867d8eccb796e27c9b2337ca5975b7c3a96b0c8974e31b6eb053ba8458c177b4541bb05a0186b0a75bb3222c0127844a4a55088d
- SSDEEP 24576:RHIAtrvbTt1tonMBsp6TKYwghM3gvaKfsOW9tgzyHeDHorGCsJoO71XsOAAszM3n:dDH4p6mea3gvaKUBHevpDD8okpFsld
- TLSH
  T1B5A59E13A59901ECD077D1F8CA675A13EB717C49032076EB12F0B9652F27AE68E7EB01
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  Project Ultimate/Bin/Xeno.dll
- Size 2.1MB
- SHA256 4befac1dc4116ddbd1b43a3b589aaf9ca1c9330c6ad36b72c7c3abdb686f959b
- MD5 d00c6e885cbb0e6171005901dbb213b5
- SHA1 62d0c135916e56ed38d455021660cc2a6f464c66
- SHA512 9b06f1e60da56fde5f917ae7867d8eccb796e27c9b2337ca5975b7c3a96b0c8974e31b6eb053ba8458c177b4541bb05a0186b0a75bb3222c0127844a4a55088d
- SSDEEP 24576:RHIAtrvbTt1tonMBsp6TKYwghM3gvaKfsOW9tgzyHeDHorGCsJoO71XsOAAszM3n:dDH4p6mea3gvaKUBHevpDD8okpFsld
- TLSH
  T1B5A59E13A59901ECD077D1F8CA675A13EB717C49032076EB12F0B9652F27AE68E7EB01
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Project Ultimate/Bin/current_version.txt
- Size 5B
- SHA256 e1cb79b8bbad0d3924995d2e16971fe3440ce2464d59d88604925c0d6b0b6c5d
- MD5 b0019d9bc76b51b9510ca0d022c3a4ab
- SHA1 8db1f2ba026cc9818b43e4a7b73cdb9462d24952
- SHA512 df23b820ab78e7096736f841b529e17cd89aa089c52dc75c6b1207e0bd7956c0cd30d7a681d2b3cec35e7f8cae9ab66ebde82dccce9cfbb866d23c067e971766
- MD5 SHA1 SHA512
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  Project Ultimate/Bin/libcrypto-3-x64.dll
- Size 7.1MB
- SHA256 16e85806333aa3b3a4fe8c31c9402b78ee01a4a143e9031db165c48386dd6289
- MD5 b47c9988a203a596803837c128853517
- SHA1 2f669bf535dde5727989da919ffa5c36cf9d78e2
- SHA512 24874b5902785cea67d3781e59471e6b8fb8c9d9e6e33e8c894745eb4324bfa1ab123ff2809269e1a7b2eb604343efe556183479c0e0d30214dec252c31fb69b
- SSDEEP 196608:uHhm399Xki0GiR/8yGX26ui1CPwDvt3uFOxC:uHhm399XkifiR/8rGfi1CPwDvt3uFoC
- TLSH
  T164767BADA67C0109E8AA81BDC2979327D771B91957F013CF186196F80F23FD92B7A740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Project Ultimate/Bin/libcurl.dll
- Size 637KB
- SHA256 8645f1b6bec48f061e54941ec1d9c5e4b8096ce1a80d8ea0a0353e4cb557f8f5
- MD5 8c14feded4b94c4b72af1f710f236778
- SHA1 62dd8f17cff9916faa792a8188f8e82ed6edf9c8
- SHA512 c0222d788aef2be7eb205f923302a79b59ec6018210944cf6d807b073fcd2c08182f42e4a1766b7e42e190ac4ebb090f6afe026a52e5bb11f585db180bbe0fc8
- SSDEEP 12288:EzbJ84IyhxblduSGHhphyfiuEkatR5YI80OdnmqKENG:EzbJ84pjbWSGHz1uEkatR5YI80Odnmqt
- TLSH
  T13CD46C56B3F414A9D1A7C17CC6538227E3B2B0542361A7DB12B4CBBA6F13BE2573A350
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  Project Ultimate/Bin/libssl-3-x64.dll
- Size 1.4MB
- SHA256 bfc059e16951fa90cc14489a8263f35c6703e762f2f5413682b4f7935bbced57
- MD5 754fff93ed112eb26bd4a6b0e8300deb
- SHA1 de9edf5c9ac80b1f26dcc91d89791065097a7d23
- SHA512 05d215d1e0cd65a98cf55a2a5e123992e5719006eb346261c0c03a629cfe2cde910765a1a87a3f5a93d2371ea9c15d677277b903d55c24731bcc7c7eed87a71a
- SSDEEP 24576:CV6b+rLptrBSFH+tK8olR+WmXWdEVB36eVE:CV6bedt9UlIzWdEVB3a
- TLSH
  T1F1656CAAA7B8019CD5B6C17CC2934B23D2B6F4162370A7DF0A658A781F63BD5173D384
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  Project Ultimate/Bin/xxhash.dll
- Size 46KB
- SHA256 73c84884a2ccde1d10bec0820a6661920e70e4b53fa99ad510acf5ed1b36af97
- MD5 0e9fecea29b2b3d5ef064e112436e9d1
- SHA1 69423218652f7837766ce03fe9edeaf751266cc5
- SHA512 bd57bc9b8298faffc091b928537794a50c81d985d60edba7863e2976846cb08fd469c6054ff7ec574df6f0a2aea1fb72ed9cff44fa219e834129876293cd2e93
- SSDEEP 768:SAziPp7yW4k3QDn24NuDUSu0MKQVMNKuxYAuogba4Mk3Qi9fCCFmj6I2:SAziR74kgDn2rDRuIrN5mAvgbTgihCCp
- TLSH
  T146234B47ECC94ACDE967EB7CC77B49CBE4D9362827114AE3C6E654A100A37C06737682
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  Project Ultimate/Bin/zlib1.dll
- Size 88KB
- SHA256 f6b58fdde3bfef2c25c7254fadfed12d86d81c4a5c962262715868c48063fc76
- MD5 68cf6f98cb8b227814a59ff3f909a0af
- SHA1 0383a4d7a74417d3ec90526e61b7637256e0bb57
- SHA512 b59f9eeededd1f76f048b57ae753f79227aead32006fc649532a9bae3f441515bab85338d25b26e5002c54c65d661c0c3048f5c3c1ded6274638ee950afb4744
- SSDEEP 1536:QvkS6XmTzqbKxfXOTBpp/foyUaDmjGI23aIOcIOZhhkxBJNJ5:PdXozwBppnqG3oSZfkxBJNJ5
- TLSH
  T1C5936B4AAAB412A5D6F78178D8D207ADC331701407A44BDF9648A7691F23BE41F363FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  Project Ultimate/Bin/zstd.dll
- Size 638KB
- SHA256 6c63d08182dede465c95e48a235894e598a61cc24e0ba4556637cc9c1a1e0951
- MD5 567198a0119e3e2ec94208f1cda7aa28
- SHA1 350224b13d1cc2f944a4a2bdd951e9ef80be5784
- SHA512 ed01636af37932dca7aa7709389dba184e16f93aa3be4fe622850df0f791c85111367a10434edf0c986079069a3574e0acdbbac4d9cae9c58fc01f9f034f40ec
- SSDEEP 6144:IbauYl+rrR8uT4uB5uWYfO16oMynnjDHM8YHb96pddEybNFZeW8aLx492bDKIbbW:IbauYGT5BYMxjDHM809sddEyb9eWo2W
- TLSH
  T19ED49E83F69542EDC07BD079C6564327EBB238061310AAEB83A4DF652F17EE55B38391
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  Project Ultimate/Microsoft.VisualStudio.LiveShare.dll
- Size 24KB
- SHA256 37a4a3f2016e6319a3fd942075b24ecbb7d145ce11b4682099beabffea5794af
- MD5 cef68fea22b3ef340e59db23f84f135f
- SHA1 0ec5b40a8d6fe32a255668344306ff71a624abc1
- SHA512 3f08132f6ace58560ce3790a8e7eb50ba993798fd2bc0879892671f23f63826921c0c4933e10f561ce2d7db5fb4deff43cd01c1de0d14179cbd62296a73400c7
- SSDEEP 768:2x2olAl7lllllllllWl/l43EdUI8v6v8V:G25ITEV
- TLSH
  T18EB26D3DD3A85333DEF76D31A9F2C1832D38B3C62521951E0A08E6851D57BD99E3163A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22
- Target
  Project Ultimate/Newtonsoft.Json.dll
- Size 704KB
- SHA256 f0c07af0e84d4dd4da4bd7823ba4535bc0481b3bf623ed40b659b68147a6bb75
- MD5 24704261e701b49b51e40c1292ed149e
- SHA1 db8ce5e0b7d8c14920bc9c4eebe51bdf706e3fc6
- SHA512 8ef6a6196044862a9d8d53c6a88e68d9591edf244385bc4888cb9c16c942eeb4a1689c49245d6cf80d619e95f0745898513ed2b67a6fc4c65fbc06b872f72184
- SSDEEP 12288:65RsO50fsVuW3icGomHAQ/DUHIdGFRrDTOAPKfhUUNSUmTIcvABXyoJl8fCfB5qm:om2VuaOKdKSUNz0IpBXyov8fC3
- TLSH
  T178E45B2177FC8E16D9EF2375B430D9181BF1F956A2BAE78FA504D9A51C837918C203A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  Project Ultimate/Project Ultimate.exe
- Size 34.7MB
- SHA256 e1b70b73f807036a3f7d751c515fe31a20c1c8b773d83eecfb8cc7f7b0e3cc35
- MD5 6a574b58de9d3bf8f0ff4be6ee27db77
- SHA1 ae0db5d4d60e26ea4820e61476f273e9ba5386af
- SHA512 762983550bbd71af3352ab5cddcc42576ddd245bb716e903b00f05edb1827d586f3b9640d71cf4cc49c8e31d04fa3270618d879b6dca3f55e3530af598404c73
- SSDEEP 12288:+mnk7iLJbpIpiRL6I2WhSKQ9ZsfZQSVn9:miLJbpI7I2WhQqZ7V9
- TLSH
  T1AE87AF02BAD2C072D57161344D3AE725DEBDBD202835897B73E61D9AED30190A73A7B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

remotehost defense_evasion discovery remcos persistence rat trojan
- Family: Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- UAC bypass
  defense_evasion trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral25 behavioral26
- Target
  Project Ultimate/Project Ultimate.exe.config
- Size 189B
- SHA256 47e5a0f101af4151d7f13d2d6bfa9b847d5b5e4a98d1f4674b7c015772746cdf
- MD5 9dbad5517b46f41dbb0d8780b20ab87e
- SHA1 ef6aef0b1ea5d01b6e088a8bf2f429773c04ba5e
- SHA512 43825f5c26c54e1fc5bffcce30caad1449a28c0c9a9432e9ce17d255f8bf6057c1a1002d9471e5b654ab1de08fb6eabf96302cdb3e0fb4b63ba0ff186e903be8
- TLSH
  T17CC080454054BD274D334B1357518539EFB073A36424140CF42FA7560F3114D4657377
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral27 behavioral28
- Target
  Project Ultimate/Project Ultimate.pdb
- Size 51KB
- SHA256 6b3d2362a9f73c86c26877cd591d4b5ab5da9b1a626a5851a40c77447cfe8050
- MD5 29ab10d35b5a0a177b8c1ef5021c8dc8
- SHA1 11fba2823ab4372f1e85e30a2da327dda994598a
- SHA512 25dcf32c7a1d48c6bd12781accf28641593d685b59e5e0bcf7a8298074cb4da63d76273bd8bd37a1cc69ccdb12be4957537c9f02d0f61914ea7959f200970984
- SSDEEP 384:i5DDhBDDmB824a4cEC1zRH9ECeeggtuNvc7k7YPNU7k6GfuTuLZBQtP5B824wGf4:i5DDvDDma24aFFIBY9uKZYRa241h6
- TLSH
  T1A1337107B744CA73C8714AF22A974F3D5238FE458B829BCB2369B1BC6EF67580D84254
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral29 behavioral30
- Target
  Project Ultimate/QuorumAPI.deps.json
- Size 1KB
- SHA256 d3dfd2693a278d23026d95ce73ad979ea4e256093af890ff8ea077a432623441
- MD5 4c5d6c7afa0eda0f181b77f9aa5e432b
- SHA1 9168888dc98a6ee8b5747871dddfc097458f0b3c
- SHA512 8b738bcafa37c1b2786dd753db90728bab803bb0fd618be7fb9ef87f50fd34d8185df5f7f92edebfa7cc7476e94599e6afddf767b049b34888a6424d43079880
- TLSH
  T1FD213818E2A05EB792B227A1547D0546F236AA7B40032D1F38FD168C4F73A4BA055F36
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31 behavioral32