Remcos_v7[.]2[.]6_Light[.]7z

Sharing

Copy URL Twitter E-mail

General

Target
Remcos_v7.2.6_Light.7z
Size 45.5MB
Sample260809-g7t5aascpc
SHA256 7e94844bcec5692d54c9b61ef2faf94726bfc08830b434c04b2b7cc16a712e4c
MD5 f96685b405dd51f74a0ccc58b2abd3b9
SHA1 2c8e7df5b5cb56c55279e7241c2625d20727720b
SHA512 f69ac78c621bfeb65804ffac10fa0d9126fb8785e18ebe14bae84e110bb575a90cdc63804110a2c055d78bcf64c62b40787ab148361b2540f34e1476206426b3
SSDEEP 786432:o1Jc72/Jp2LElnjm+nky/+xPRlA8FR+GIHLg22F8PmBuv/i1XBJxg0kxR1hlNXVT:57u2LE5m+kyElAIrYrBuBui1XBJxg0kl
TLSH
T1FEA7333406596F3E6ECCAAECEC6D2AE93644518164F366E5E0D1CEB04E622F131DF909
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Remcos_v7.2.6_Light/Remcos v7.2.6 Light.exe

File Explorer

Remcos_v7.2.6_Light.7z

.7z 45.5MB
Remcos_v7.2.6_Light/ReadMe.txt

2KB
Remcos_v7.2.6_Light/Remcos v7.2.6 Light.exe

.exe 46.0MB
Remcos_v7.2.6_Light/update_notes.txt

411B
Remcos_v7.2.6_Light/zip_password.txt

38B

Remcos_v7.2.6_Light.7z

SHA256 7e94844bcec5692d54c9b61ef2faf94726bfc08830b434c04b2b7cc16a712e4c
MD5 f96685b405dd51f74a0ccc58b2abd3b9
SHA1 2c8e7df5b5cb56c55279e7241c2625d20727720b
SHA512 f69ac78c621bfeb65804ffac10fa0d9126fb8785e18ebe14bae84e110bb575a90cdc63804110a2c055d78bcf64c62b40787ab148361b2540f34e1476206426b3
SSDEEP 786432:o1Jc72/Jp2LElnjm+nky/+xPRlA8FR+GIHLg22F8PmBuv/i1XBJxg0kxR1hlNXVT:57u2LE5m+kyElAIrYrBuBui1XBJxg0kl
TLSH
T1FEA7333406596F3E6ECCAAECEC6D2AE93644518164F366E5E0D1CEB04E622F131DF909
MD5 SHA1 SHA512 SSDEEP TLSH

Remcos_v7.2.6_Light/Remcos v7.2.6 Light.exe

IMPHASH b13fde6bd5eb9691b2ff946e3f6c36c7
SHA256 3a39f5dc7b6917c0f62371930c02e5453d49f8189b949d2bce3d420ac75ba83c
MD5 6acddf2618f8fe229c9b756dcbb1bb81
SHA1 8443e9ab8daa54ff4e3686efb8ad57e251b2dc20
SHA512 4dcd83a1f680177c9a04858cee6df162ea8d9d5ddddde6a2c359d946377b81c469af8eb1e1db37a09017d89d9df7fa02567cbf9f21cf14b7bef60d8c62c4c8dc
SSDEEP 786432:7u+mR7bppsO/9J3+8tyq/FtOVCSu+9hTRS+8+nBm4DJQINPHN0wmUILJ+Y3Xd8BY:3ApJ/95+qFtok2d+qBmEQINPHN0wmUgV
TLSH
T134B73369194646EBDAC91EF4A719F7FF33B495D048937876A4C0E8BC46327AC30CE606
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

77806204

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

winmm

PlaySoundW mciSendCommandW timeGetTime mciGetErrorStringW

wininet

InternetCloseHandle InternetReadFile InternetOpenW InternetOpenUrlW

winspool.drv

DocumentPropertiesW ClosePrinter OpenPrinterW GetDefaultPrinterW EnumPrintersW

comdlg32

GetSaveFileNameW GetOpenFileNameW

comctl32

ImageList_GetImageInfo FlatSB_SetScrollInfo InitCommonControls ImageList_DragMove ImageList_Destroy _TrackMouseEvent ImageList_DragShowNolock ImageList_Add FlatSB_SetScrollProp ImageList_GetDragImage ImageList_Create ImageList_EndDrag ImageList_DrawEx ImageList_SetImageCount FlatSB_GetScrollPos FlatSB_SetScrollPos InitializeFlatSB ImageList_Copy FlatSB_GetScrollInfo ImageList_Write ImageList_DrawIndirect ImageList_SetBkColor ImageList_GetBkColor ImageList_BeginDrag ImageList_GetIcon ImageList_Replace ImageList_GetImageCount ImageList_DragEnter ImageList_GetIconSize ImageList_SetIconSize ImageList_Read ImageList_DragLeave ImageList_LoadImageW ImageList_Draw ImageList_Remove ImageList_ReplaceIcon ImageList_SetOverlayImage

ws2_32

htons connect inet_addr closesocket inet_ntoa socket

shell32

SHGetFileInfoW Shell_NotifyIconW SHAppBarMessage ShellExecuteW ShellExecuteA ShellExecuteExW

user32

MoveWindow CopyImage SetMenuItemInfoW GetMenuItemInfoW DefFrameProcW GetDlgCtrlID FrameRect RegisterWindowMessageW GetMenuStringW FillRect SendMessageA IsClipboardFormatAvailable EnumWindows ShowOwnedPopups GetClassInfoExW GetClassInfoW GetScrollRange SetActiveWindow GetActiveWindow DrawEdge GetKeyboardLayoutList LoadBitmapW EnumChildWindows GetScrollBarInfo UnhookWindowsHookEx SetCapture GetCapture ShowCaret CreatePopupMenu GetMenuItemID CharLowerBuffW PostMessageW SetWindowLongW IsZoomed SetParent DrawMenuBar GetClientRect IsChild IntersectRect IsIconic CallNextHookEx ShowWindow GetWindowTextW SetForegroundWindow IsDialogMessageW DestroyWindow RegisterClassW EndMenu CharNextW GetFocus GetDC SetFocus ReleaseDC GetClassLongW SetScrollRange DrawTextW PeekMessageA MessageBeep SetClassLongW SetRectEmpty RemovePropW GetSubMenu DestroyIcon IsWindowVisible FlashWindow PtInRect DispatchMessageA UnregisterClassW GetTopWindow SendMessageW GetComboBoxInfo LoadStringW CreateMenu CharLowerW SetWindowRgn SetWindowPos GetMenuItemCount GetSysColorBrush GetWindowDC DrawTextExW EnumClipboardFormats GetScrollInfo SetWindowTextW GetMessageExtraInfo GetSysColor EnableScrollBar TrackPopupMenu DrawIconEx GetClassNameW GetMessagePos GetIconInfo SetScrollInfo GetKeyNameTextW GetDesktopWindow SetCursorPos GetCursorPos SetMenu GetMenuState GetMenu SetRect GetKeyState IsRectEmpty ValidateRect GetCursor KillTimer WaitMessage TranslateMDISysAccel GetWindowPlacement GetMenuItemRect CreateIconIndirect CreateWindowExW ChildWindowFromPoint GetDCEx PeekMessageW MonitorFromWindow GetUpdateRect MessageBoxA SetTimer WindowFromPoint BeginPaint RegisterClipboardFormatW MapVirtualKeyW OffsetRect IsWindowUnicode DispatchMessageW CreateAcceleratorTableW DefMDIChildProcW GetSystemMenu SetScrollPos GetScrollPos InflateRect DrawFocusRect ReleaseCapture LoadCursorW ScrollWindow GetLastActivePopup GetSystemMetrics CharUpperBuffW SetClipboardData GetClipboardData ClientToScreen SetWindowPlacement GetMonitorInfoW CheckMenuItem CharUpperW DefWindowProcW GetForegroundWindow EnableWindow GetWindowThreadProcessId RedrawWindow EndPaint MsgWaitForMultipleObjectsEx LoadKeyboardLayoutW ActivateKeyboardLayout GetParent MonitorFromRect InsertMenuItemW GetPropW MessageBoxW SetPropW UpdateWindow MsgWaitForMultipleObjects DestroyMenu SetWindowsHookExW EmptyClipboard GetDlgItem AdjustWindowRectEx IsWindow DrawIcon EnumThreadWindows InvalidateRect GetKeyboardState ScreenToClient DrawFrameControl SetCursor CreateIcon RemoveMenu GetKeyboardLayoutNameW OpenClipboard TranslateMessage MapWindowPoints EnumDisplayMonitors CallWindowProcW CountClipboardFormats CloseClipboard DestroyCursor CopyIcon PostQuitMessage ShowScrollBar EnableMenuItem HideCaret FindWindowExW MonitorFromPoint LoadIconW SystemParametersInfoW GetWindow GetWindowRect GetWindowLongW InsertMenuW IsWindowEnabled IsDialogMessageA FindWindowW GetKeyboardLayout DeleteMenu

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

oleaut32

SafeArrayPutElement GetErrorInfo VariantInit VariantClear SysFreeString SafeArrayAccessData SysReAllocStringLen SafeArrayCreate SafeArrayGetElement GetActiveObject SysAllocStringLen SafeArrayUnaccessData SafeArrayPtrOfIndex VariantCopy SafeArrayGetUBound SafeArrayGetLBound VariantChangeType

wtsapi32

WTSUnRegisterSessionNotification WTSRegisterSessionNotification

advapi32

RegSetValueExW RegConnectRegistryW RegEnumKeyExW RegLoadKeyW GetUserNameW RegDeleteKeyW RegOpenKeyExW RegQueryInfoKeyW RegUnLoadKeyW RegSaveKeyW RegDeleteValueW RegReplaceKeyW RegFlushKey RegQueryValueExW RegEnumValueW RegCloseKey RegCreateKeyExW RegRestoreKeyW

msvcrt

memcpy memset

kernel32

SetFileAttributesW GetFileType QueryDosDeviceW GetACP GetExitCodeProcess CloseHandle LocalFree GetCurrentProcessId SizeofResource VirtualProtect QueryPerformanceFrequency IsDebuggerPresent FindNextFileW GetFullPathNameW VirtualFree GetProcessHeap ExitProcess HeapAlloc GetCPInfoExW GlobalSize RtlUnwind GetCPInfo EnumSystemLocalesW GetStdHandle GetTimeZoneInformation FileTimeToLocalFileTime GetModuleHandleW FreeLibrary TryEnterCriticalSection HeapDestroy DebugBreak FileTimeToDosDateTime ReadFile CreateProcessW GetLastError GetModuleFileNameW SetLastError GlobalAlloc GlobalUnlock FindResourceW CreateThread CompareStringW GetFileSizeEx MapViewOfFile CreateMutexW LoadLibraryA GetVolumeInformationW ResetEvent MulDiv FreeResource GetDriveTypeW GetVersion DeleteFileA RaiseException MoveFileW GlobalAddAtomW FormatMessageW SwitchToThread GetExitCodeThread OutputDebugStringW GetCurrentThread IsBadReadPtr EndUpdateResourceA LoadLibraryExW LockResource BeginUpdateResourceW FileTimeToSystemTime GetCurrentThreadId UnhandledExceptionFilter GlobalFindAtomW VirtualQuery GlobalFree VirtualQueryEx Sleep EnterCriticalSection SetFilePointer LoadResource SuspendThread GetTickCount WritePrivateProfileStringW UpdateResourceA GetFileSize GlobalDeleteAtom GetStartupInfoW GetFileAttributesW SetCurrentDirectoryW GetCurrentDirectoryW InitializeCriticalSection GetThreadPriority GetCurrentProcess GlobalLock SetThreadPriority VirtualAlloc GetTempPathW GetCommandLineW GetSystemInfo LeaveCriticalSection GetProcAddress ResumeThread GetLogicalDriveStringsW GetVersionExW VerifyVersionInfoW HeapCreate GetProcessAffinityMask LCMapStringW GetDiskFreeSpaceW VerSetConditionMask FindFirstFileW GetUserDefaultUILanguage GetConsoleOutputCP UnmapViewOfFile GetConsoleCP GlobalHandle lstrlenW QueryPerformanceCounter SetEndOfFile lstrcmpW HeapFree WideCharToMultiByte FindClose MultiByteToWideChar LoadLibraryW SetEvent GetLocaleInfoW CreateFileW SystemTimeToFileTime EnumResourceNamesW DeleteFileW GetEnvironmentVariableW GetLocalTime WaitForSingleObject WriteFile CreateFileMappingW ExitThread CreatePipe DeleteCriticalSection GetDateFormatW TlsGetValue SetErrorMode GetComputerNameW IsValidLocale TlsSetValue GetSystemDefaultUILanguage CreateDirectoryW EnumCalendarInfoW LocalAlloc RemoveDirectoryW CreateEventW GetPrivateProfileStringW WaitForMultipleObjectsEx GetThreadLocale SetThreadLocale

wsock32

accept htons setsockopt select WSAStartup listen bind socket recv inet_ntoa closesocket WSAGetLastError send

ole32

IsEqualGUID ProgIDFromCLSID OleInitialize CLSIDFromProgID OleUninitialize CoInitialize CoCreateInstance CoUninitialize CoTaskMemFree CoTaskMemAlloc StringFromCLSID

gdi32

Pie SetBkMode CreateCompatibleBitmap CreatePolygonRgn BeginPath GetEnhMetaFileHeader CloseEnhMetaFile RectVisible AngleArc CloseFigure StrokeAndFillPath ResizePalette SetAbortProc SetTextColor GetTextColor StretchBlt PathToRegion SetArcDirection ExtSelectClipRgn RoundRect SelectClipRgn RestoreDC SetRectRgn FillPath GetTextMetricsW GetWindowOrgEx CreatePalette CreateDCW CreateICW CreatePen PolyBezierTo GetStockObject CreateSolidBrush GetBkMode Polygon MoveToEx PlayEnhMetaFile Ellipse StartPage GetBitmapBits SetTextCharacterExtra GetTextCharacterExtra StartDocW AbortDoc GetSystemPaletteEntries GetEnhMetaFileBits CreatePenIndirect GetEnhMetaFilePaletteEntries SetMapMode GetMapMode CreateFontIndirectW PolyBezier ExtCreatePen LPtoDP EndDoc GetObjectW GetCurrentObject GetWinMetaFileBits SetROP2 PtVisible GetEnhMetaFileDescriptionW CreateEllipticRgnIndirect ArcTo CreateEnhMetaFileW Arc PolylineTo TextOutW SelectPalette SetGraphicsMode ExcludeClipRect SetWindowOrgEx MaskBlt EndPage EndPath DeleteEnhMetaFile Chord SetDIBits SetViewportOrgEx GetViewportOrgEx CreateRectRgn RealizePalette SetDIBColorTable GetDIBColorTable CreateBrushIndirect StrokePath PatBlt SelectClipPath SetEnhMetaFileBits Rectangle DeleteDC SaveDC BitBlt SetWorldTransform FrameRgn GetDeviceCaps GetTextExtentPoint32W GetClipBox GetClipRgn Polyline IntersectClipRect CreateBitmap CombineRgn SetWinMetaFileBits CreateDIBitmap GetStretchBltMode CreateDIBSection SetStretchBltMode GetDIBits ExtCreateRegion LineTo GetRgnBox EnumFontsW SetWindowExtEx CreateHalftonePalette DeleteObject SelectObject ExtFloodFill UnrealizeObject CopyEnhMetaFileW SetBkColor GetBkColor CreateCompatibleDC GetObjectA GetBrushOrgEx GetCurrentPositionEx SetDCPenColor GetNearestPaletteIndex SetTextAlign GetTextAlign CreateRoundRectRgn GetTextExtentPointW ExtTextOutW SetBrushOrgEx GetPixel GdiFlush SetViewportExtEx SetPixel EnumFontFamiliesExW StretchDIBits WidenPath GetPaletteEntries

ntdll

RtlDecompressBuffer RtlCompressBuffer RtlGetCompressionWorkSpaceSize

Name

.text

Size

Virtual Size

5.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

63KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

424KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didata

Size

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

Virtual Size

111B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

Virtual Size

84B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

Virtual Size

93B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.viotto0

Size

Virtual Size

64.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.viotto1

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.viotto2

Size

45.7MB

Virtual Size

45.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

282KB

Virtual Size

281KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Remcos_v7.2.6_Light.7z

Remcos_v7.2.6_Light/ReadMe.txt

Remcos_v7.2.6_Light/Remcos v7.2.6 Light.exe

winmm

wininet

winspool.drv

comdlg32

comctl32

ws2_32

shell32

user32

version

oleaut32

wtsapi32

advapi32

msvcrt

kernel32

wsock32

ole32

gdi32

ntdll

generic

Remcos_v7.2.6_Light/update_notes.txt

Remcos_v7.2.6_Light/zip_password.txt