remcos | 2026-06-28_7959b13f6396c7add04b6c499bb7d53c_coinminer_elex_luca-stealer_mespinoza_njrat_remcos

General

Target
2026-06-28_7959b13f6396c7add04b6c499bb7d53c_coinminer_elex_luca-stealer_mespinoza_njrat_remcos
Size 451KB
Sample260628-1ca8gafs8k
SHA256 722c62569705ce8a253d0c0a00e591e206f7f048052a68638ae786cb0a0ed1bc
MD5 7959b13f6396c7add04b6c499bb7d53c
SHA1 10ae1c67f78e3a1a88c7dca4f506400e7af46642
SHA512 02787c24ca2f973cd06e523927beaf761211da1141bc9da5b25ab03e2b6d7021023397473efc8cc8aedeeabe7479fcba554a75edfff2bfdcf2ef0f06de9eaad4
SSDEEP 6144:q3FnZ2yKRCsGEmJ/1rG+RC3jHQMhbnMbR91StHx1JRsAOZZsSXxlc2An9:qyasGZJ9ysCzHQMpnwaH/JRsfZsGQn9
TLSH
T11BA4BE02B9C1C072DD761038443D6F26DEBCFD212935957BA3E6086AEE73181A7397B6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

remotehost rat remcos

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

90.242.163.41:2404

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
RuntimeBroker.exe
delete_file
false
hide_file
false
hide_keylog_file
true
install_flag
true
install_path
%WinDir%\System32
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
Log
keylog_path
%Temp%
mouse_option
false
mutex
Rmc-YJVD2X
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

detects Windows exceutables potentially bypassing UAC using eventvwr.exe 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-28_7959b13f6396c7add04b6c499bb7d53c_coinminer_elex_luca-stealer_mespinoza_njrat_remcos

File Explorer

2026-06-28_7959b13f6396c7add04b6c499bb7d53c_coinminer_elex_luca-stealer_mespinoza_njrat_remcos

.exe 451KB

2026-06-28_7959b13f6396c7add04b6c499bb7d53c_coinminer_elex_luca-stealer_mespinoza_njrat_remcos

SHA256 722c62569705ce8a253d0c0a00e591e206f7f048052a68638ae786cb0a0ed1bc
MD5 7959b13f6396c7add04b6c499bb7d53c
SHA1 10ae1c67f78e3a1a88c7dca4f506400e7af46642
SHA512 02787c24ca2f973cd06e523927beaf761211da1141bc9da5b25ab03e2b6d7021023397473efc8cc8aedeeabe7479fcba554a75edfff2bfdcf2ef0f06de9eaad4
SSDEEP 6144:q3FnZ2yKRCsGEmJ/1rG+RC3jHQMhbnMbR91StHx1JRsAOZZsSXxlc2An9:qyasGZJ9ysCzHQMpnwaH/JRsfZsGQn9
TLSH
T11BA4BE02B9C1C072DD761038443D6F26DEBCFD212935957BA3E6086AEE73181A7397B6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

206756

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

337KB

Virtual Size

340KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

93KB

Virtual Size

96KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

3KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

1024B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

14KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

2026-06-28_7959b13f6396c7add04b6c499bb7d53c_coinminer_elex_luca-stealer_mespinoza_njrat_remcos