remcos | 2026-08-04_a35425ca071002223a4f6b7c5c982d75_elex_parallax_remcos_remocs_wannacry

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_a35425ca071002223a4f6b7c5c982d75_elex_parallax_remcos_remocs_wannacry
Size 120KB
Sample260804-grrdfsxth1
SHA256 5fe0b74aa38a380ed03cf1fc88220b140666f20cae2c9224440404ba4b49deba
MD5 a35425ca071002223a4f6b7c5c982d75
SHA1 1f76f15599cb921ffde555a466b1438e813bfce9
SHA512 f9fb1854f3b2dbe7a8e65a44d721f3d6a47e983e17bcc46ea6dc592afa2dfa7b8a0710679012de849f9227da9f5bb093b6dc084054fafcadc2a4ca2ceaf396c9
SSDEEP 3072:Vo9ouOQ4BuxSH6uWp2hc5YZ10RJ1QUNfqYXarXWwH5Y+zQMCdw:Vo9o5Q/xSavpiciJtYXarXWwH++zQMCy
TLSH
T138C30B57F34686A2E82603B107417FB6EBBCBC360A6D7153C388D1811D7588BE465ABF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat remcos

Malware Config

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

detects Windows exceutables potentially bypassing UAC using eventvwr.exe 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_a35425ca071002223a4f6b7c5c982d75_elex_parallax_remcos_remocs_wannacry

File Explorer

2026-08-04_a35425ca071002223a4f6b7c5c982d75_elex_parallax_remcos_remocs_wannacry

.exe 120KB

2026-08-04_a35425ca071002223a4f6b7c5c982d75_elex_parallax_remcos_remocs_wannacry

IMPHASH a419d76c18731315640607e1e8189149
SHA256 5fe0b74aa38a380ed03cf1fc88220b140666f20cae2c9224440404ba4b49deba
MD5 a35425ca071002223a4f6b7c5c982d75
SHA1 1f76f15599cb921ffde555a466b1438e813bfce9
SHA512 f9fb1854f3b2dbe7a8e65a44d721f3d6a47e983e17bcc46ea6dc592afa2dfa7b8a0710679012de849f9227da9f5bb093b6dc084054fafcadc2a4ca2ceaf396c9
SSDEEP 3072:Vo9ouOQ4BuxSH6uWp2hc5YZ10RJ1QUNfqYXarXWwH5Y+zQMCdw:Vo9o5Q/xSavpiciJtYXarXWwH++zQMCy
TLSH
T138C30B57F34686A2E82603B107417FB6EBBCBC360A6D7153C388D1811D7588BE465ABF
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

78804

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CopyFileW GetLongPathNameW CreateMutexA OpenMutexA Process32NextW Process32FirstW CreateToolhelp32Snapshot SizeofResource LockResource LoadResource FindResourceA GetLocaleInfoA OpenProcess GetCurrentProcessId lstrcatW GetTempFileNameW GetTempPathW GetTickCount GlobalUnlock ExpandEnvironmentStringsA GlobalAlloc GetCurrentProcess ResumeThread SetThreadContext WriteProcessMemory VirtualAllocEx ReadProcessMemory GetThreadContext VirtualAlloc CreateProcessW GlobalFree LocalAlloc DuplicateHandle GetCurrentThread lstrcpynA GetModuleFileNameA ExitProcess AllocConsole GetStartupInfoA FindFirstFileA FindNextFileA DeleteFileA GetLastError CreateFileMappingA MapViewOfFileEx RemoveDirectoryW SetFileAttributesW TerminateThread FindClose GetLogicalDriveStringsA GetFileAttributesW DeleteFileW GetFileSize SetFilePointer GetDriveTypeA lstrlenA FindFirstFileW FindNextFileW LoadLibraryA GetProcAddress CreatePipe CreateProcessA PeekNamedPipe ReadFile TerminateProcess SetEvent HeapCreate HeapFree GetLocalTime CreateEventA WaitForSingleObject GetModuleFileNameW CreateDirectoryW CreateFileW WriteFile CloseHandle ExitThread Sleep GetModuleHandleA GlobalLock CreateThread

user32

CallNextHookEx GetKeyState GetWindowTextA GetWindowTextLengthA GetForegroundWindow UnhookWindowsHookEx CloseClipboard GetClipboardData OpenClipboard SetWindowTextW SetClipboardData EmptyClipboard ExitWindowsEx MessageBoxW GetKeyboardLayoutNameA GetWindowThreadProcessId ShowWindow CloseWindow IsWindowVisible GetWindowTextW EnumWindows DrawIcon GetIconInfo SendInput SystemParametersInfoW CreateWindowExA RegisterClassExA AppendMenuA CreatePopupMenu TrackPopupMenu SetForegroundWindow GetCursorPos DefWindowProcA DispatchMessageA SetWindowsHookExA GetKeyboardLayout GetMessageA FindWindowA TranslateMessage

gdi32

CreateDCA CreateCompatibleDC GetDeviceCaps CreateCompatibleBitmap DeleteDC DeleteObject SelectObject StretchBlt GetDIBits GetObjectA

advapi32

GetUserNameW ChangeServiceConfigW QueryServiceStatus ControlService OpenSCManagerW StartServiceW OpenSCManagerA EnumServicesStatusW OpenServiceW QueryServiceConfigW RegOpenKeyExA RegDeleteKeyA RegCloseKey RegQueryValueExA RegQueryValueExW RegOpenKeyExW RegSetValueExA RegCreateKeyA RegSetValueExW RegCreateKeyW RegDeleteValueW RegEnumValueW RegEnumKeyExW RegQueryInfoKeyW RegCreateKeyExW AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken CloseServiceHandle RegEnumKeyExA

shell32

ShellExecuteW ExtractIconA Shell_NotifyIconA ShellExecuteExA

msvcp60

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@IDABV?$allocator@D@1@@Z ?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z ??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z ??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z ??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGIABV?$allocator@G@1@@Z ??8std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z ?size@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ ??_D?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ ?close@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ ??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z ??0?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAE@PBDH@Z ??8std@@YA_NPBGABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@@Z ?replace@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IIPBG@Z ?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGI@Z ?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@@Z ??8std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z ?find_last_of@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGI@Z ?find_last_of@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIGI@Z ??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z ?is_open@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QBE_NXZ ??0Init@ios_base@std@@QAE@XZ ??1Init@ios_base@std@@QAE@XZ ??0_Winit@std@@QAE@XZ ??1_Winit@std@@QAE@XZ ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z ?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ ?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@IGABV?$allocator@G@1@@Z ?begin@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ ?end@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ ?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEPADXZ ?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z ?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXID@Z ?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEPADXZ ??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z ?empty@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE_NXZ ?begin@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ ?end@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ ?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIABV12@I@Z ?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z ?data@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ ??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z ??0logic_error@std@@QAE@ABV01@@Z ??0out_of_range@std@@QAE@ABV01@@Z ??1out_of_range@std@@UAE@XZ ??0out_of_range@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV?$allocator@G@1@@Z ??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ ?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z ??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z ??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDIABV?$allocator@D@1@@Z ?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ ??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z ??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@PBG@Z ??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@0@Z ??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@G@Z ?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB ??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBGABV10@@Z ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z ?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ ??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z ?length@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ ??9std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z ?empty@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE_NXZ ??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z ??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@IIABV?$allocator@D@1@@Z ??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z ??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z ??9std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z ?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@D@Z ??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z ??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@G@Z ?resize@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXI@Z ?rfind@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIGI@Z ?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB ?substr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE?AV12@II@Z ?length@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z

shlwapi

PathFileExistsA PathFileExistsW StrToIntA

msvcrt

sprintf _controlfp __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _acmdln _XcptFilter _exit _onexit __dllonexit ??1type_info@@UAE@XZ _iob freopen wcscat _itow srand rand swprintf _wsystem wcscpy wcslen _wgetenv toupper _itoa tolower wcscmp _wrename getenv printf strncmp malloc free __CxxFrameHandler time localtime strftime atoi _ftol ??2@YAPAXI@Z _CxxThrowException ??0exception@@QAE@ABV0@@Z exit _except_handler3

winmm

waveInStart waveInClose waveInUnprepareHeader waveInPrepareHeader waveInStop waveInAddBuffer waveInOpen

ws2_32

htons gethostbyname closesocket socket WSAStartup inet_ntoa recv send connect

urlmon

URLDownloadToFileW URLOpenBlockingStreamW

gdiplus

GdipLoadImageFromStream GdipFree GdipDisposeImage GdipCloneImage GdipAlloc GdipSaveImageToStream GdipSaveImageToFile GdiplusStartup GdipGetImageEncoders GdipLoadImageFromStreamICM GdipGetImageEncodersSize

wininet

InternetCloseHandle InternetOpenUrlA InternetOpenA InternetReadFile