remcos | x190ba491e82d47d1caa6197962e775f1886bffb7fe9babbeac2c390c983331f8[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
x190ba491e82d47d1caa6197962e775f1886bffb7fe9babbeac2c390c983331f8.exe
Size 124KB
Sample260710-e483xsc12l
SHA256 190ba491e82d47d1caa6197962e775f1886bffb7fe9babbeac2c390c983331f8
MD5 7444b3375ffab1a2096fbef8828424c9
SHA1 b56b0e2be0525d429e23de6e2c34343238de16d3
SHA512 277d3979d3e66f25e310ac2d2a415fad6ead7c86db3373548cdb9e03d1c7aca4bf63c3cb3e53e27bf608cfff290eedf68311a20cd0bcbd98fb1b42863efcdee0
SSDEEP 1536:F9QYtE1FJz3/6T8tf5ey+HS/PCHHV2r1k2rKiIdEXmJY+zqh7lMQMWa0E:rQCENiny+HSiHHVY1k29IZJY+zQMQF
TLSH
T111C3F7076306D5A3E42782B017817F92DABCECA30A366153C3E8D5911E7989AF43767F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

chinemerem rat remcos

Malware Config

Extracted

Family

remcos

Version

2.2.2 Pro

Botnet

chinemerem

remcoss.onmypc.org:3765

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
5
copy_file
remcos.exe
copy_folder
remcos
delete_file
false
hide_file
false
hide_keylog_file
true
install_flag
false
install_path
%AppData%
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
r-8ET8H0
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
x190ba491e82d47d1caa6197962e775f1886bffb7fe9babbeac2c390c983331f8.exe

File Explorer

x190ba491e82d47d1caa6197962e775f1886bffb7fe9babbeac2c390c983331f8.exe

.exe 124KB

x190ba491e82d47d1caa6197962e775f1886bffb7fe9babbeac2c390c983331f8.exe

IMPHASH a419d76c18731315640607e1e8189149
SHA256 190ba491e82d47d1caa6197962e775f1886bffb7fe9babbeac2c390c983331f8
MD5 7444b3375ffab1a2096fbef8828424c9
SHA1 b56b0e2be0525d429e23de6e2c34343238de16d3
SHA512 277d3979d3e66f25e310ac2d2a415fad6ead7c86db3373548cdb9e03d1c7aca4bf63c3cb3e53e27bf608cfff290eedf68311a20cd0bcbd98fb1b42863efcdee0
SSDEEP 1536:F9QYtE1FJz3/6T8tf5ey+HS/PCHHV2r1k2rKiIdEXmJY+zqh7lMQMWa0E:rQCENiny+HSiHHVY1k29IZJY+zQMQF
TLSH
T111C3F7076306D5A3E42782B017817F92DABCECA30A366153C3E8D5911E7989AF43767F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

78804

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CopyFileW GetLongPathNameW CreateMutexA OpenMutexA Process32NextW Process32FirstW CreateToolhelp32Snapshot SizeofResource LockResource LoadResource FindResourceA GetLocaleInfoA OpenProcess GetCurrentProcessId lstrcatW GetTempFileNameW GetTempPathW GetTickCount GlobalUnlock ExpandEnvironmentStringsA GlobalAlloc GetCurrentProcess ResumeThread SetThreadContext WriteProcessMemory VirtualAllocEx ReadProcessMemory GetThreadContext VirtualAlloc CreateProcessW GlobalFree LocalAlloc DuplicateHandle GetCurrentThread lstrcpynA GetModuleFileNameA ExitProcess AllocConsole GetStartupInfoA FindFirstFileA FindNextFileA DeleteFileA GetLastError CreateFileMappingA MapViewOfFileEx RemoveDirectoryW SetFileAttributesW TerminateThread FindClose GetLogicalDriveStringsA GetFileAttributesW DeleteFileW GetFileSize SetFilePointer GetDriveTypeA lstrlenA FindFirstFileW FindNextFileW LoadLibraryA GetProcAddress CreatePipe CreateProcessA PeekNamedPipe ReadFile TerminateProcess SetEvent HeapCreate HeapFree GetLocalTime CreateEventA WaitForSingleObject GetModuleFileNameW CreateDirectoryW CreateFileW WriteFile CloseHandle ExitThread Sleep GetModuleHandleA GlobalLock CreateThread

user32

CallNextHookEx GetKeyState GetWindowTextA GetWindowTextLengthA GetForegroundWindow UnhookWindowsHookEx CloseClipboard GetClipboardData OpenClipboard SetWindowTextW SetClipboardData EmptyClipboard ExitWindowsEx MessageBoxW GetKeyboardLayoutNameA GetWindowThreadProcessId ShowWindow CloseWindow IsWindowVisible GetWindowTextW EnumWindows DrawIcon GetIconInfo SendInput SystemParametersInfoW CreateWindowExA RegisterClassExA AppendMenuA CreatePopupMenu TrackPopupMenu SetForegroundWindow GetCursorPos DefWindowProcA DispatchMessageA SetWindowsHookExA GetKeyboardLayout GetMessageA FindWindowA TranslateMessage

gdi32

CreateDCA CreateCompatibleDC GetDeviceCaps CreateCompatibleBitmap DeleteDC DeleteObject SelectObject StretchBlt GetDIBits GetObjectA

advapi32

GetUserNameW ChangeServiceConfigW QueryServiceStatus ControlService OpenSCManagerW StartServiceW OpenSCManagerA EnumServicesStatusW OpenServiceW QueryServiceConfigW RegOpenKeyExA RegDeleteKeyA RegCloseKey RegQueryValueExA RegQueryValueExW RegOpenKeyExW RegSetValueExA RegCreateKeyA RegSetValueExW RegCreateKeyW RegDeleteValueW RegEnumValueW RegEnumKeyExW RegQueryInfoKeyW RegCreateKeyExW AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken CloseServiceHandle RegEnumKeyExA

shell32

ShellExecuteW ExtractIconA Shell_NotifyIconA ShellExecuteExA

msvcp60

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@IDABV?$allocator@D@1@@Z ?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z ??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z ??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z ??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGIABV?$allocator@G@1@@Z ??8std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z ?size@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ ??_D?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ ?close@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ ??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z ??0?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAE@PBDH@Z ??8std@@YA_NPBGABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@@Z ?replace@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IIPBG@Z ?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGI@Z ?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@@Z ??8std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z ?find_last_of@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGI@Z ?find_last_of@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIGI@Z ??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z ?is_open@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QBE_NXZ ??0Init@ios_base@std@@QAE@XZ ??1Init@ios_base@std@@QAE@XZ ??0_Winit@std@@QAE@XZ ??1_Winit@std@@QAE@XZ ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z ?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ ?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@IGABV?$allocator@G@1@@Z ?begin@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ ?end@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ ?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEPADXZ ?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z ?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXID@Z ?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEPADXZ ??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z ?empty@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE_NXZ ?begin@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ ?end@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ ?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIABV12@I@Z ?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z ?data@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ ??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z ??0logic_error@std@@QAE@ABV01@@Z ??0out_of_range@std@@QAE@ABV01@@Z ??1out_of_range@std@@UAE@XZ ??0out_of_range@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV?$allocator@G@1@@Z ??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ ?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z ??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z ??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDIABV?$allocator@D@1@@Z ?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ ??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z ??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@PBG@Z ??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@0@Z ??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@G@Z ?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB ??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBGABV10@@Z ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z ?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ ??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z ?length@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ ??9std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z ?empty@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE_NXZ ??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z ??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@IIABV?$allocator@D@1@@Z ??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z ??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z ??9std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z ?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@D@Z ??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z ??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@G@Z ?resize@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXI@Z ?rfind@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIGI@Z ?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB ?substr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE?AV12@II@Z ?length@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z

shlwapi

PathFileExistsA PathFileExistsW StrToIntA

msvcrt

sprintf _controlfp __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _acmdln _XcptFilter _exit _onexit __dllonexit ??1type_info@@UAE@XZ _iob freopen wcscat _itow srand rand swprintf _wsystem wcscpy wcslen _wgetenv toupper _itoa tolower wcscmp _wrename getenv printf strncmp malloc free __CxxFrameHandler time localtime strftime atoi _ftol ??2@YAPAXI@Z _CxxThrowException ??0exception@@QAE@ABV0@@Z exit _except_handler3

winmm

waveInStart waveInClose waveInUnprepareHeader waveInPrepareHeader waveInStop waveInAddBuffer waveInOpen

ws2_32

htons gethostbyname closesocket socket WSAStartup inet_ntoa recv send connect

urlmon

URLDownloadToFileW URLOpenBlockingStreamW

gdiplus

GdipLoadImageFromStream GdipFree GdipDisposeImage GdipCloneImage GdipAlloc GdipSaveImageToStream GdipSaveImageToFile GdiplusStartup GdipGetImageEncoders GdipLoadImageFromStreamICM GdipGetImageEncodersSize

wininet

InternetCloseHandle InternetOpenUrlA InternetOpenA InternetReadFile