remcos | 532af7026091f1b8eea917ef49903baaa68aca440b334cee8ac22ec7c56aae62

General

Target
Upaavirkeligheden.exe
Size 497KB
Sample260720-ajqcvshw4p
SHA256 532af7026091f1b8eea917ef49903baaa68aca440b334cee8ac22ec7c56aae62
MD5 03c4f2ac25272be107adcc0dcc1ef8ff
SHA1 8e15d9199f093f1cd945b8f78bc5d6193879fd11
SHA512 a8afe9ee6a44ddd0530fd90d82967191fb1010957b4f9c491dbfcbdb3385ad25fc3ad117a71282ce6e2e75171e7ede9bf1da71ae87d893008255e2ebda3a084a
SSDEEP 12288:qBQEiDvu2SfA+nMR+9IbtT2bNWEa+ZPQYc2jSkfrcy:qBeD9S9n99CJbEa+ncGQy
TLSH
T101B40241FFE698E8D876C13597FAE1A31431BE9C0968621F56247E7FBD70A90C93A301
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

remcos

Version

7.2.6 Pro

Botnet

JESUS CHRIST

C2

45.225.135.94:2404

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
armsvcc-3GADD5
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Targets

- Target
  Upaavirkeligheden.exe
- Size 497KB
- SHA256 532af7026091f1b8eea917ef49903baaa68aca440b334cee8ac22ec7c56aae62
- MD5 03c4f2ac25272be107adcc0dcc1ef8ff
- SHA1 8e15d9199f093f1cd945b8f78bc5d6193879fd11
- SHA512 a8afe9ee6a44ddd0530fd90d82967191fb1010957b4f9c491dbfcbdb3385ad25fc3ad117a71282ce6e2e75171e7ede9bf1da71ae87d893008255e2ebda3a084a
- SSDEEP 12288:qBQEiDvu2SfA+nMR+9IbtT2bNWEa+ZPQYc2jSkfrcy:qBeD9S9n99CJbEa+ncGQy
- TLSH
  T101B40241FFE698E8D876C13597FAE1A31431BE9C0968621F56247E7FBD70A90C93A301
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

jesus christ defense_evasion remcos rat trojan
- Family: Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- UAC bypass
  defense_evasion trojan
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 25KB
- SHA256 c7dd8cc8323e295b8821b0e320de208a7e20c068a8be8d03857520451ce9ded7
- MD5 4abf19a47044ec746aa8c600f0bc149f
- SHA1 69da1e4f654b044d7b3c845c12a07c988bf26eb8
- SHA512 65727cbe3f03e0dceba06d206054e60adba321d29159b4bfb690c30b2ccd1a0a05a08c2aa50ac270fcd28557f4b482f492c36b0d7b7b980b477cd8971559610e
- SSDEEP 384:jZ2pfUx9eVLwDKO9XYD/isN7lCEjgwMU/ktKi+R45Duwomq8pqdDvH81Q:jr96YIrx7lC7vU/kaG9uLmCdb
- TLSH
  T1DEB24C07F38398BFC51BC17186EF5772AA32BE211B616F6F1220F5756E24EA0871DA14
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 14KB
- SHA256 a0a6431feb4e09018d99acdc02f2139fbacd68420b0f84d4b22a9e091aaac707
- MD5 48452d7f73a0e73b62a16b4c88068a60
- SHA1 ef5a3edd25cf3cf664e93c38fbe9034ce652d117
- SHA512 83dae4699678c2eb245bb3a5758b9decdae308042bf50a36266222a9c20f197503baad9f58f2522c6bfe32ad62b8af6ab6b8f99f2e51b72383f6c50d4d699274
- SSDEEP 192:PZWhF6MuqMgfdPvg/YWkNLiY8vSKXS6Hn5gIIblaks8NHAHPEdeqe4KFz0:hWh4MFv1w/YWCLXASKi6nAlHJAl4KW
- TLSH
  T13852191B7B42962ACD0AE374D5EF573322F3F4551138370E0669DB49BFE1660DA39288
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6