remcos | 0e4a1a47f31e041f6986a27457733d898e5edc0cb78d4199aaee2ad47a236fd3

Sharing

Copy URL Twitter E-mail

General

Target
0e4a1a47f31e041f6986a27457733d898e5edc0cb78d4199aaee2ad47a236fd3
Size 92KB
Sample260724-y4envsscma
SHA256 0e4a1a47f31e041f6986a27457733d898e5edc0cb78d4199aaee2ad47a236fd3
MD5 faf0b507c1a3093bf80c8c7b35c98899
SHA1 3ee23fb745a26ee7e83fb164392e85e65bc3d876
SHA512 31bca7908c0e0fc7a85b123df099c61704cdb153b7c06596afdb24146b83dc329d4eb8a0c06c126ee6f124b0ee98c843f4b0929be397e4c78269837fbe5d7abf
SSDEEP 1536:IhhW0YTGZWdVseJxaM9kraLdV2QkQ1TbPX8IHOCkIsI4ESHNTh9E+JP19qkP6d4n:OhzYTGWVvJ8f2v1TbPzuMsIFSHNThy+R
TLSH
T15C93D813FA4AD0B2E46591F146426F31CEBCBC3636492173D38FCA41AD79892D416EBE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

host rat remcos

Malware Config

Extracted

Family

remcos

Version

1.7 Pro

Botnet

Host

o8-app.cloud:443
o8-app.cloud:80
gg88bet.asia:80
gg88bet.asia:443

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
5
copy_file
remcos.exe
copy_folder
remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
remcos_flcrsrvmcphzdam
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screens
screenshot_path
%AppData%
screenshot_time
1
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0e4a1a47f31e041f6986a27457733d898e5edc0cb78d4199aaee2ad47a236fd3

File Explorer

0e4a1a47f31e041f6986a27457733d898e5edc0cb78d4199aaee2ad47a236fd3

.exe 92KB

0e4a1a47f31e041f6986a27457733d898e5edc0cb78d4199aaee2ad47a236fd3

IMPHASH d3a62971944197f0701c7049a9c739d1
SHA256 0e4a1a47f31e041f6986a27457733d898e5edc0cb78d4199aaee2ad47a236fd3
MD5 faf0b507c1a3093bf80c8c7b35c98899
SHA1 3ee23fb745a26ee7e83fb164392e85e65bc3d876
SHA512 31bca7908c0e0fc7a85b123df099c61704cdb153b7c06596afdb24146b83dc329d4eb8a0c06c126ee6f124b0ee98c843f4b0929be397e4c78269837fbe5d7abf
SSDEEP 1536:IhhW0YTGZWdVseJxaM9kraLdV2QkQ1TbPX8IHOCkIsI4ESHNTh9E+JP19qkP6d4n:OhzYTGWVvJ8f2v1TbPzuMsIFSHNThy+R
TLSH
T15C93D813FA4AD0B2E46591F146426F31CEBCBC3636492173D38FCA41AD79892D416EBE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

64904

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetModuleFileNameA GetLongPathNameA CreateMutexA OpenMutexA Process32Next Process32First CreateToolhelp32Snapshot SizeofResource LockResource LoadResource FindResourceA GetLocaleInfoA Process32NextW Process32FirstW lstrlenA GetDriveTypeA CreateProcessA GetTickCount GlobalUnlock GlobalLock GlobalAlloc WinExec GetCurrentProcessId CreateDirectoryW CopyFileA GetFileAttributesW GetLogicalDriveStringsA GetCurrentProcess ResumeThread SetThreadContext WriteProcessMemory VirtualAllocEx ReadProcessMemory GetThreadContext VirtualAlloc GlobalFree LocalAlloc TerminateProcess ReadFile PeekNamedPipe GetStdHandle CreatePipe OpenProcess DuplicateHandle GetCurrentThread lstrcpynA ExitProcess AllocConsole GetStartupInfoA ExpandEnvironmentStringsA FindFirstFileA FindNextFileA GetLastError LoadLibraryA GetProcAddress CreateFileMappingA MapViewOfFileEx DeleteFileA RemoveDirectoryA CloseHandle GetFileAttributesA SetFileAttributesA SetEvent TerminateThread FindFirstFileW FindNextFileW FindClose GetLocalTime CreateEventA WaitForSingleObject CreateDirectoryA ExitThread Sleep GetModuleHandleA DeleteFileW CreateThread

user32

GetWindowTextLengthA GetForegroundWindow UnhookWindowsHookEx CloseClipboard GetClipboardData OpenClipboard SetClipboardData EmptyClipboard ExitWindowsEx MessageBoxA GetKeyboardLayoutNameA GetWindowThreadProcessId ShowWindow CloseWindow GetWindowTextA GetWindowTextW EnumWindows SendInput CreateWindowExA RegisterClassExA AppendMenuA CreatePopupMenu TrackPopupMenu SetForegroundWindow GetCursorPos DefWindowProcA GetKeyState CallNextHookEx SetWindowsHookExA GetMessageA TranslateMessage GetKeyboardLayout FindWindowA DispatchMessageA IsWindowVisible

gdi32

CreateDCA CreateCompatibleDC GetDeviceCaps CreateCompatibleBitmap SelectObject StretchBlt GetObjectA GetDIBits DeleteObject DeleteDC

advapi32

OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegCreateKeyExA RegQueryInfoKeyA RegEnumKeyExA RegEnumValueA RegDeleteValueA RegCreateKeyA RegSetValueExA RegOpenKeyExA RegDeleteKeyA RegCloseKey RegQueryValueExA GetUserNameW

shell32

ShellExecuteA ExtractIconA Shell_NotifyIconA ShellExecuteExA ShellExecuteW

msvcp60

?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEPADXZ ?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEPADXZ ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@@Z ?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IIPBD@Z ??8std@@YA_NPBDABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z ??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z ??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV?$allocator@G@1@@Z ?find_last_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z ??9std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z ??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@G@Z ?substr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE?AV12@II@Z ?rfind@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIGI@Z ?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB ?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z ??0Init@ios_base@std@@QAE@XZ ??1Init@ios_base@std@@QAE@XZ ??0_Winit@std@@QAE@XZ ??1_Winit@std@@QAE@XZ ?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z ?find_last_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z ??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBGABV10@@Z ??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z ??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@DABV10@@Z ?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z ?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z ?begin@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ ?end@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ ?length@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ ??Bios_base@std@@QBEPAXXZ ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z ?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@IDABV?$allocator@D@1@@Z ??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z ??0?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAE@PBDH@Z ?is_open@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QBE_NXZ ?data@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ ??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z ??0logic_error@std@@QAE@ABV01@@Z ??0out_of_range@std@@QAE@ABV01@@Z ??1out_of_range@std@@UAE@XZ ??0out_of_range@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ ?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z ??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z ??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z ??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDIABV?$allocator@D@1@@Z ??_D?$basic_fstream@DU?$char_traits@D@std@@@std@@QAEXXZ ?close@?$basic_fstream@DU?$char_traits@D@std@@@std@@QAEXXZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBDH@Z ?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@JW4seekdir@ios_base@2@@Z ??0?$basic_fstream@DU?$char_traits@D@std@@@std@@QAE@PBDH@Z ??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z ??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@D@Z ?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ ??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z ?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB ?length@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ ??9std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z ?empty@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE_NXZ ??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z ?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIABV12@I@Z ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z ??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@0@Z ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z ??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ ?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ ??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@PBG@Z ?end@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ ?begin@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ ??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@G@Z ??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z ??_D?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ ?close@?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PADH@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@JW4seekdir@ios_base@2@@Z ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@H@2@XZ ?is_open@?$basic_ifstream@DU?$char_traits@D@std@@@std@@QBE_NXZ ??0?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAE@PBDH@Z ??_D?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ ?close@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ ??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z

msvcrt

_wrename _controlfp __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _acmdln _XcptFilter _exit _onexit __dllonexit ??1type_info@@UAE@XZ _iob freopen srand rand mbstowcs realloc _itoa sprintf getenv toupper tolower wcscmp printf strncmp malloc free _EH_prolog __CxxFrameHandler time localtime strftime puts atoi _ftol ??2@YAPAXI@Z _except_handler3 exit ??0exception@@QAE@ABV0@@Z _CxxThrowException

winmm

waveInOpen waveInStop waveInClose waveInAddBuffer waveInPrepareHeader waveInUnprepareHeader waveInStart

shlwapi

PathFileExistsA

ws2_32

htons gethostbyname closesocket socket send WSAGetLastError connect recv WSAStartup

urlmon

URLDownloadToFileA

gdiplus

GdipLoadImageFromStreamICM GdipDisposeImage GdipCloneImage GdipAlloc GdipSaveImageToStream GdipSaveImageToFile GdipLoadImageFromStream GdiplusStartup GdipGetImageEncoders GdipFree GdipGetImageEncodersSize

wininet

InternetCloseHandle InternetOpenUrlA InternetOpenA InternetReadFile