remcos | b3738f1c75e476a430aad7db37bc98b72f6315909bf4b9dc2f320d587e41174d[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
b3738f1c75e476a430aad7db37bc98b72f6315909bf4b9dc2f320d587e41174d.bin
Size 487KB
Sample260730-qj9phaaa88
SHA256 b3738f1c75e476a430aad7db37bc98b72f6315909bf4b9dc2f320d587e41174d
MD5 784ab3e8e91f0a207dea9d37433f026a
SHA1 558e2394906e94800005498e4fe7007ee46ab3e3
SHA512 0eb2c43ff8a49d1ed00ea94b80af2b51909d84330e7a23a9c4ac09a03f39f0610bdd1f48a27f0d86bf1c393ce9b5b715b546337b821708b44ecb3089c9816a9e
SSDEEP 6144:nIlSCa0RPvRz+n8Qr1D0ZGESuHabmvHOE4mCp6qtydBnP+Y4+3sAORZGFX3Xc6BJ:n200OFp+G0imvHn3Cp6qyBP+YdsvZGT
TLSH
T158B4BF01B9E2C172D57654300D2AE776DEBCBD2028358D7BB3D60D57FE30190AA39AB6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

srv rat remcos

Malware Config

Extracted

Family

remcos

Version

6.1.0 Pro

Botnet

5.181.157.26:40000
5.181.157.26:50000
5.181.157.26:4899

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
update.exe
copy_folder
RST
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
true
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
rmc
mouse_option
false
mutex
FUL-EQMFKH
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b3738f1c75e476a430aad7db37bc98b72f6315909bf4b9dc2f320d587e41174d.bin

File Explorer

b3738f1c75e476a430aad7db37bc98b72f6315909bf4b9dc2f320d587e41174d.bin

.exe 487KB

b3738f1c75e476a430aad7db37bc98b72f6315909bf4b9dc2f320d587e41174d.bin

IMPHASH 41e05d591d7d93bdd5bc6d5da04da74b
SHA256 b3738f1c75e476a430aad7db37bc98b72f6315909bf4b9dc2f320d587e41174d
MD5 784ab3e8e91f0a207dea9d37433f026a
SHA1 558e2394906e94800005498e4fe7007ee46ab3e3
SHA512 0eb2c43ff8a49d1ed00ea94b80af2b51909d84330e7a23a9c4ac09a03f39f0610bdd1f48a27f0d86bf1c393ce9b5b715b546337b821708b44ecb3089c9816a9e
SSDEEP 6144:nIlSCa0RPvRz+n8Qr1D0ZGESuHabmvHOE4mCp6qtydBnP+Y4+3sAORZGFX3Xc6BJ:n200OFp+G0imvHn3Cp6qyBP+YdsvZGT
TLSH
T158B4BF01B9E2C172D57654300D2AE776DEBCBD2028358D7BB3D60D57FE30190AA39AB6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

216420

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

FindFirstFileA FindNextFileA ExpandEnvironmentStringsA GetModuleFileNameW GetLongPathNameW CopyFileW GetLocaleInfoA VirtualProtect SetLastError VirtualFree VirtualAlloc LoadLibraryA GetNativeSystemInfo HeapAlloc GetProcessHeap FreeLibrary IsBadReadPtr GetTempPathW lstrcatW GetCurrentProcessId GetTempFileNameW GetSystemDirectoryA GlobalAlloc GlobalLock GetTickCount GlobalUnlock WriteProcessMemory ResumeThread GetThreadContext ReadProcessMemory CreateProcessW SetThreadContext LocalAlloc GlobalFree MulDiv SizeofResource QueryDosDeviceW FindFirstVolumeW GetConsoleScreenBufferInfo SetConsoleTextAttribute lstrlenW GetStdHandle SetFilePointer FindResourceA LockResource LoadLibraryW LoadResource LocalFree FindVolumeClose GetVolumePathNamesForVolumeNameW lstrcpyW SetConsoleOutputCP FormatMessageA TerminateThread AllocConsole lstrcmpW GetModuleFileNameA lstrcpynA QueryPerformanceFrequency QueryPerformanceCounter EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection HeapSize WriteConsoleW SetStdHandle SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExA HeapReAlloc ReadConsoleW GetConsoleMode GetConsoleCP FlushFileBuffers GetFileType GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW GetACP GetModuleHandleExW MoveFileExW LoadLibraryExW RaiseException RtlUnwind GetCPInfo GetStringTypeW GetLocaleInfoW LCMapStringW CompareStringW MultiByteToWideChar DecodePointer EncodePointer TlsFree TlsSetValue GetModuleHandleA RemoveDirectoryW MoveFileW SetFilePointerEx GetLogicalDriveStringsA DeleteFileW DeleteFileA SetFileAttributesW GetFileAttributesW CreateDirectoryW GetFileSize FindClose lstrlenA GetDriveTypeA FindNextFileW GetFileSizeEx FindFirstFileW GetModuleHandleW ExitProcess GetProcAddress Process32FirstW Process32NextW OpenMutexA GetLastError CreateToolhelp32Snapshot OpenProcess CreateMutexA GetCurrentProcess CreateProcessA PeekNamedPipe CreatePipe TerminateProcess ReadFile HeapFree HeapCreate CreateEventA GetLocalTime CreateThread SetEvent CreateEventW WaitForSingleObject Sleep CloseHandle ExitThread CreateFileW WriteFile FindNextVolumeW TlsGetValue TlsAlloc SwitchToThread WideCharToMultiByte InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent WaitForSingleObjectEx ResetEvent InitializeCriticalSectionAndSpinCount SetEndOfFile

user32

SetClipboardData EnumWindows ExitWindowsEx EmptyClipboard ShowWindow SetWindowTextW MessageBoxW IsWindowVisible CloseWindow SendInput EnumDisplaySettingsW mouse_event MapVirtualKeyA DrawIcon GetSystemMetrics GetIconInfo SystemParametersInfoW GetCursorPos RegisterClassExA AppendMenuA CreateWindowExA TrackPopupMenu TranslateMessage DispatchMessageA GetMessageA GetWindowTextW wsprintfW GetClipboardData UnhookWindowsHookEx GetForegroundWindow ToUnicodeEx GetKeyboardLayout SetWindowsHookExA CloseClipboard OpenClipboard GetKeyboardState GetWindowThreadProcessId GetWindowTextLengthW GetKeyState DefWindowProcA SetForegroundWindow GetKeyboardLayoutNameA CallNextHookEx CreatePopupMenu

gdi32

CreateCompatibleBitmap SelectObject CreateCompatibleDC StretchBlt GetDIBits DeleteDC DeleteObject CreateDCA GetObjectA BitBlt

advapi32

LookupPrivilegeValueA CryptAcquireContextA CryptGenRandom CryptReleaseContext GetUserNameW RegEnumKeyExA GetTokenInformation QueryServiceStatus CloseServiceHandle OpenSCManagerW OpenSCManagerA ControlService StartServiceW QueryServiceConfigW ChangeServiceConfigW OpenServiceW EnumServicesStatusW AdjustTokenPrivileges RegQueryInfoKeyW RegQueryValueExA RegCreateKeyExW RegEnumKeyExW RegSetValueExW RegSetValueExA RegOpenKeyExA RegOpenKeyExW RegCreateKeyW RegDeleteValueW RegEnumValueW RegQueryValueExW RegCreateKeyA RegCloseKey RegDeleteKeyA OpenProcessToken

shell32

ShellExecuteExA Shell_NotifyIconA ExtractIconA ShellExecuteW

ole32

CoGetObject CoInitializeEx CoUninitialize

shlwapi

StrToIntA PathFileExistsW PathFileExistsA

winmm

mciSendStringA PlaySoundW mciSendStringW waveInClose waveInStop waveInPrepareHeader waveInUnprepareHeader waveInOpen waveInAddBuffer waveInStart

ws2_32

gethostbyname WSASetLastError inet_addr gethostbyaddr getservbyport ntohs getservbyname htonl htons inet_ntoa closesocket WSAStartup send socket connect recv WSAGetLastError

urlmon

URLDownloadToFileW URLOpenBlockingStreamW

gdiplus

GdipSaveImageToStream GdipDisposeImage GdipGetImageEncodersSize GdiplusStartup GdipGetImageEncoders GdipCloneImage GdipAlloc GdipFree GdipLoadImageFromStream

wininet

InternetReadFile InternetOpenUrlW InternetOpenW InternetCloseHandle