remcos | 2bb3924ac13fbbe690c44e6c2207117428fabb4588099b84db66a0203ca00ab9

General

Target
2bb3924ac13fbbe690c44e6c2207117428fabb4588099b84db66a0203ca00ab9.exe
Size 538KB
Sample260727-c871bavtcy
SHA256 2bb3924ac13fbbe690c44e6c2207117428fabb4588099b84db66a0203ca00ab9
MD5 25d83a555f662ac46ee8a4f6a1824137
SHA1 6f0271fcdddba2037cf119041fa0d4c944d3aefd
SHA512 cb16d243b9a176e8680d868cdc4bd71f60ac98c11e01db31209d0f63b0dce47b60cbf152a47dc7b1d25743e9238f2b0d373482ce2185c2bd15be73a85a340f48
SSDEEP 6144:SYa6eJsYMZ4YdvJe+ECzk9WT+z1WyMGjhm9d6HAkbQFqTaHXxSnbrHE9+I1:SYEJsB4YxE8/CMyXhK2scTa3WbrHE9v
TLSH
T1DFC46E2564014041DA0F1F71B16D97A67923BFBA297CF21E2A3AFBD626F72C2D13614C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

remcos

Version

7.2.1 Pro

Botnet

RemoteHost

C2

107.175.246.30:2404
107.175.246.30:5000

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
true
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-M2C765
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Targets

- Target
  2bb3924ac13fbbe690c44e6c2207117428fabb4588099b84db66a0203ca00ab9.exe
- Size 538KB
- SHA256 2bb3924ac13fbbe690c44e6c2207117428fabb4588099b84db66a0203ca00ab9
- MD5 25d83a555f662ac46ee8a4f6a1824137
- SHA1 6f0271fcdddba2037cf119041fa0d4c944d3aefd
- SHA512 cb16d243b9a176e8680d868cdc4bd71f60ac98c11e01db31209d0f63b0dce47b60cbf152a47dc7b1d25743e9238f2b0d373482ce2185c2bd15be73a85a340f48
- SSDEEP 6144:SYa6eJsYMZ4YdvJe+ECzk9WT+z1WyMGjhm9d6HAkbQFqTaHXxSnbrHE9+I1:SYEJsB4YxE8/CMyXhK2scTa3WbrHE9v
- TLSH
  T1DFC46E2564014041DA0F1F71B16D97A67923BFBA297CF21E2A3AFBD626F72C2D13614C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

remotehost discovery remcos persistence rat
- Family: Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
- MD5 cff85c549d536f651d4fb8387f1976f2
- SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
- SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
- SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
- TLSH
  T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
- MD5 6c3f8c94d0727894d706940a8a980543
- SHA1 0d1bcad901be377f38d579aafc0c41c0ef8dcefd
- SHA512 2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
- SSDEEP 96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
- TLSH
  T17012F992E6A450B3C5D6533B35AA2F2DCBBD5325B0926C00C7738E4D39395B66E38353
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6