remcos | eab27aeedf308a3d237f41dec18bf293caf228add0410a63b3fda8d57497aae8

General

Target
eab27aeedf308a3d237f41dec18bf293caf228add0410a63b3fda8d57497aae8.exe
Size 330KB
Sample260703-xnb3csbs9k
SHA256 eab27aeedf308a3d237f41dec18bf293caf228add0410a63b3fda8d57497aae8
MD5 340ba0c0a4a4f53a3637015b5d41de7c
SHA1 ccf25191a1f631eb4288dbf41c33bface4be593d
SHA512 1c784b451e20e25e0dc8e2f21b6ba2270e8a7f17568b8a9bae020c2b8d7c83ee7936b907ae5c5b218026fbe3ca8d3b83a378cd9926e81679c0deba985fcd7c29
SSDEEP 6144:9mOP320cNWoP78HOpf1iDLl2r4G7fHT6Jlvi4dhMMdCRXcDmXuWnknhrJlYtWp:BtoPdNi/Sfz6Jw8hrdCRXxNEhPYt6
TLSH
T1E374122125E0CC67E8734C301F6F9EE6CA7667F943242E8F5344A69869A739C4E3C356
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

remcos

Version

7.2.5 Pro

Botnet

2026

C2

107.173.4.16:2561

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
chrome.exe
copy_folder
chrome
delete_file
true
hide_file
true
hide_keylog_file
false
install_flag
true
install_path
%ProgramFiles%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-ZCKFVM
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Targets

- Target
  eab27aeedf308a3d237f41dec18bf293caf228add0410a63b3fda8d57497aae8.exe
- Size 330KB
- SHA256 eab27aeedf308a3d237f41dec18bf293caf228add0410a63b3fda8d57497aae8
- MD5 340ba0c0a4a4f53a3637015b5d41de7c
- SHA1 ccf25191a1f631eb4288dbf41c33bface4be593d
- SHA512 1c784b451e20e25e0dc8e2f21b6ba2270e8a7f17568b8a9bae020c2b8d7c83ee7936b907ae5c5b218026fbe3ca8d3b83a378cd9926e81679c0deba985fcd7c29
- SSDEEP 6144:9mOP320cNWoP78HOpf1iDLl2r4G7fHT6Jlvi4dhMMdCRXcDmXuWnknhrJlYtWp:BtoPdNi/Sfz6Jw8hrdCRXxNEhPYt6
- TLSH
  T1E374122125E0CC67E8734C301F6F9EE6CA7667F943242E8F5344A69869A739C4E3C356
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

2026 discovery remcos persistence rat
- Family: Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 c2f405d7402f815d0c3fadd9a50f0bbbb1bab9aa38fe347823478a2587299448
- MD5 9625d5b1754bc4ff29281d415d27a0fd
- SHA1 80e85afc5cccd4c0a3775edbb90595a1a59f5ce0
- SHA512 dce52b640897c2e8dbfd0a1472d5377fa91fb9cf1aeff62604d014bccbe5b56af1378f173132abeb0edd18c225b9f8f5e3d3e72434aed946661e036c779f165b
- SSDEEP 192:eX24sihno00Wfl97nH6BenXwWobpWBTtvShJ5omi7dJWjOlqSlS:D8QIl972eXqlWBFSt273YOlqz
- TLSH
  T1BD325D06235081F3E1914138846B3E175F6A15069BF58E97DFD38646BE30BE7BD79503
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 86c8ee210e6611383a634dcb8c60455063ddae3d7adccbeacf3adf7bf2a46676
- MD5 d2e45dd852a659e11897df573832f381
- SHA1 19990ee627c95b6c18d3b5c5f0ec5c24791d0af5
- SHA512 93c9fa1767f3e861fe5765f2940aaba9eee6396d069c443ac6cbaccc88441b2bfc3c3af50a8044161f96bb7eb81af1bc6c1fa754d89740d0a2a8d591fef11073
- SSDEEP 192:o18cSzvTyl4tgi8pPjQM0PuAg0YNyfIFtSP:8BSzm+t18pZ0WAg0RfIFg
- TLSH
  T1A612F793E5E420B3C6D3523F35BE2B2EC7BD5335B0512C0482738A497A6947A6E38347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6