remcos | 6c42329f51259956370c9b16374abb59efa967487075b139cee3dfc118af2fc6

General

Target
POTVRDENIE_PLATBY_TRANSAKCIA_UKONČENÁ_4710005.lzh
Size 469KB
Sample260721-n2h86aev8k
SHA256 6c42329f51259956370c9b16374abb59efa967487075b139cee3dfc118af2fc6
MD5 9306b1d82580602f0034197e783a1038
SHA1 f8c8960b92429e73a30b654e3c9d4b16746f29ad
SHA512 12fd8fbd2b0bf3b4e2ccf8809cb7ad713da0012bdba35170fc698006d338398da51239b68e6c8cbb0ee7d1abc56f463bb5c2799e4cba23a6ff62291b023a293c
SSDEEP 6144:nczmNfYqw1tkKDTirc13a750yty79r0axGh3nG6l/3ZCsZcLlIawuHiT7rWqmUKZ:cq6LXkUa40H3H53ZNcLlIapCTRjk
TLSH
T100A423A39EBE4364A69340D5AF630CA479B1B397F3498916D324CADED07C3105A63FB0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

glassgoldcoin.duckdns.org:443
greatmindsplay.duckdns.org:443

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-KVAVU9
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Extracted

Family

remcos

Version

7.2.6 Pro

Botnet

RemoteHost

C2

glassgoldcoin.duckdns.org:443
greatmindsplay.duckdns.org:443

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-KVAVU9
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Targets

- Target
  POTVRDENIE_PLATBY_TRANSAKCIA_UKONČENÁ_4710005.lzh
- Size 469KB
- SHA256 6c42329f51259956370c9b16374abb59efa967487075b139cee3dfc118af2fc6
- MD5 9306b1d82580602f0034197e783a1038
- SHA1 f8c8960b92429e73a30b654e3c9d4b16746f29ad
- SHA512 12fd8fbd2b0bf3b4e2ccf8809cb7ad713da0012bdba35170fc698006d338398da51239b68e6c8cbb0ee7d1abc56f463bb5c2799e4cba23a6ff62291b023a293c
- SSDEEP 6144:nczmNfYqw1tkKDTirc13a750yty79r0axGh3nG6l/3ZCsZcLlIawuHiT7rWqmUKZ:cq6LXkUa40H3H53ZNcLlIapCTRjk
- TLSH
  T100A423A39EBE4364A69340D5AF630CA479B1B397F3498916D324CADED07C3105A63FB0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  POTVRDENIE_PLATBY_TRANSAKCIA_UKONCENA_4710005.js
- Size 1.5MB
- SHA256 1ae08131cd9f6cea99f046b4a016e2630a2e9b8c2562e498cf2a414838b51653
- MD5 d4b28da1db42c3e3f6cb509cae324f59
- SHA1 e1c9687f1ecf219c7a5ffbb8b5cffaeea7788031
- SHA512 efcbc0028f86ff1365987168b090f33e7f2b261f33e769b5c4acf27eadbe4e8ee0aab75d766552be3caabf208756face206742b33febf2a9feb406516ffa79ee
- SSDEEP 24576:x7bj6U8zEAaiD9mwVRQ6j5UpnydmQlF+b4k3eQHDwR:x7bj6U8zEAaiD9mwVRQ6j5UpnydmQl44
- TLSH
  T1FE758F8169442656182B0F085D71710F4B2F336C9839B1FC1F2A16AD4FFBC6F89AA76D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

remotehost collection discovery execution remcos persistence rat
- Family: Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Registers new Windows logon scripts automatically executed at logon.
  persistence
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral3 behavioral4