General
- Target 2026-07-29_7da933b4a444e518292c5e6bc74ef941_cobalt-strike_icedid_njrat_satacom_stealc
- Size 508KB
- Sample260729-c6wt9ssfre
- SHA256 c7298f4139d91018ccc1fa806d4f65229b10b8f8003d7ac8865eecb5d8f27ffe
Score
10/10
Malware Config
Extracted
Family
-
remcos
Version
-
7.2.5 Pro
Botnet
-
24046
C2
-
62.60.226.68:24046
Attributes
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
sys64.exe
-
copy_folder
Config
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
true
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
TRY788-O2HVLN
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
- Target 2026-07-29_7da933b4a444e518292c5e6bc74ef941_cobalt-strike_icedid_njrat_satacom_stealc
- Size 508KB
- SHA256 c7298f4139d91018ccc1fa806d4f65229b10b8f8003d7ac8865eecb5d8f27ffe
Score10/10-
Family: Remcos
Remcos is a closed-source remote control and surveillance software.
-
Suricata alert: REMCOS RAT Malware Inbound C2 Communication
Network activity triggered a Suricata alert
-
Suricata alert: REMCOS RAT Malware Outbound C2 Communication
Network activity triggered a Suricata alert
-
Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application