remcos | 2026-08-09_a35b95ed914f77deee8748d3b1674a20_cobalt-strike_coinminer_icedid_njrat_remcos_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_a35b95ed914f77deee8748d3b1674a20_cobalt-strike_coinminer_icedid_njrat_remcos_vidar
Size 934KB
Sample260809-k2nbbsvand
SHA256 fac3a5c1aeceeced11a41909b24f08250f4aee33c0eca1bd3dfa3c94b759de5d
MD5 a35b95ed914f77deee8748d3b1674a20
SHA1 316b9845039dcf6ce1aa97b059a5244f03c484dd
SHA512 bac247f2bafccb762f2fbeaa7feac2caaea06f620ea632d6730829ff6a9a53385e941fcb5892e06dc7e7391d6af8a4aa13f0b273b9f7165090b250b9aacd2b38
SSDEEP 12288:6aMwmp7scoHvln/+iB9PQoYYUPGmPou5uFyWuHeK/bRF+h6Z:57mScoHvln/+aPQoYDPGmP35v2
TLSH
T14D158C4572C446F4D47AC2B1CA8B403BD272BD096670853F02D6BB7B4F376629B2A727
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

remotehost rat remcos

Malware Config

Extracted

Family

remcos

Version

7.1.0 Pro

Botnet

RemoteHost

199.217.99.47:443

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-9WFRYO
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-09_a35b95ed914f77deee8748d3b1674a20_cobalt-strike_coinminer_icedid_njrat_remcos_vidar

File Explorer

2026-08-09_a35b95ed914f77deee8748d3b1674a20_cobalt-strike_coinminer_icedid_njrat_remcos_vidar

.exe 934KB

2026-08-09_a35b95ed914f77deee8748d3b1674a20_cobalt-strike_coinminer_icedid_njrat_remcos_vidar

IMPHASH 8b3e0763eddbb01367bd21396e110071
SHA256 fac3a5c1aeceeced11a41909b24f08250f4aee33c0eca1bd3dfa3c94b759de5d
MD5 a35b95ed914f77deee8748d3b1674a20
SHA1 316b9845039dcf6ce1aa97b059a5244f03c484dd
SHA512 bac247f2bafccb762f2fbeaa7feac2caaea06f620ea632d6730829ff6a9a53385e941fcb5892e06dc7e7391d6af8a4aa13f0b273b9f7165090b250b9aacd2b38
SSDEEP 12288:6aMwmp7scoHvln/+iB9PQoYYUPGmPou5uFyWuHeK/bRF+h6Z:57mScoHvln/+aPQoYDPGmP35v2
TLSH
T14D158C4572C446F4D47AC2B1CA8B403BD272BD096670853F02D6BB7B4F376629B2A727
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

274908

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetModuleFileNameW CreateToolhelp32Snapshot Process32NextW Process32FirstW GetLongPathNameW CopyFileW InitializeCriticalSection GetLocaleInfoA VirtualProtect HeapFree SetLastError VirtualFree VirtualAlloc LoadLibraryA GetNativeSystemInfo HeapAlloc GetProcessHeap FreeLibrary IsBadReadPtr GetTempPathW OpenProcess lstrcatW GetCurrentProcessId GetTempFileNameW GetSystemDirectoryA GlobalAlloc GlobalLock GetTickCount GlobalUnlock LocalAlloc GlobalFree MulDiv SizeofResource QueryDosDeviceW FindFirstVolumeW GetConsoleScreenBufferInfo SetConsoleTextAttribute lstrlenW GetStdHandle SetFilePointer FindResourceA FormatMessageW LockResource LoadLibraryW LoadResource LocalFree FindVolumeClose GetVolumePathNamesForVolumeNameW lstrcpyW SetConsoleOutputCP FormatMessageA FindNextVolumeW AllocConsole lstrcmpW FindNextFileA Wow64SetThreadContext Wow64GetThreadContext GetThreadContext SetThreadContext ResumeThread GetModuleFileNameA lstrcpynA QueryPerformanceFrequency QueryPerformanceCounter DeleteCriticalSection SetEndOfFile HeapSize WriteConsoleW SetStdHandle SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExA HeapReAlloc ReadConsoleW GetConsoleMode GetConsoleCP FlushFileBuffers GetFileType GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW GetACP GetModuleHandleExW MoveFileExW LoadLibraryExW RaiseException RtlPcToFileHeader RtlUnwindEx GetCPInfo GetStringTypeW GetLocaleInfoW LCMapStringW CompareStringW MultiByteToWideChar DecodePointer EncodePointer FindFirstFileA GetFileSize TerminateThread GetModuleHandleA RemoveDirectoryW MoveFileW SetFilePointerEx GetLogicalDriveStringsA DeleteFileW CreateDirectoryW ExpandEnvironmentStringsA DeleteFileA GetLastError SetFileAttributesW GetFileAttributesW FindClose lstrlenA GetDriveTypeA FindNextFileW GetFileSizeEx FindFirstFileW GetModuleHandleW ExitProcess GetProcAddress OpenMutexA CreateMutexA GetCurrentProcess CreateProcessA PeekNamedPipe CreatePipe TerminateProcess ReadFile CreateEventA GetLocalTime CreateThread SetEvent CreateEventW WaitForSingleObject Sleep CloseHandle ExitThread CreateFileW LeaveCriticalSection WriteFile EnterCriticalSection WriteProcessMemory TlsFree TlsSetValue TlsGetValue TlsAlloc SwitchToThread WideCharToMultiByte InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext WaitForSingleObjectEx ResetEvent InitializeCriticalSectionAndSpinCount RtlUnwind

user32

SetForegroundWindow SetClipboardData EnumWindows ExitWindowsEx EmptyClipboard ShowWindow SetWindowTextW MessageBoxW IsWindowVisible CloseWindow SendInput EnumDisplaySettingsW mouse_event MapVirtualKeyA DrawIcon TrackPopupMenu TranslateMessage DispatchMessageA GetMessageA GetWindowTextW wsprintfW GetClipboardData UnhookWindowsHookEx GetForegroundWindow ToUnicodeEx GetKeyboardLayout SetWindowsHookExA CloseClipboard OpenClipboard GetKeyboardState CreatePopupMenu CreateWindowExA AppendMenuA RegisterClassExA GetCursorPos GetWindowTextLengthW GetKeyState GetKeyboardLayoutNameA CallNextHookEx SystemParametersInfoW GetIconInfo GetSystemMetrics GetWindowThreadProcessId DefWindowProcA

gdi32

CreateCompatibleBitmap SelectObject CreateCompatibleDC StretchBlt GetDIBits DeleteDC DeleteObject CreateDCA GetObjectA BitBlt

advapi32

AdjustTokenPrivileges CryptAcquireContextA CryptGenRandom CryptReleaseContext GetUserNameW RegEnumKeyExA GetTokenInformation QueryServiceStatus CloseServiceHandle OpenSCManagerW OpenSCManagerA ControlService StartServiceW QueryServiceConfigW ChangeServiceConfigW OpenServiceW EnumServicesStatusW RegDeleteKeyA LookupPrivilegeValueA OpenProcessToken RegQueryInfoKeyW RegQueryValueExA RegCreateKeyExW RegEnumKeyExW RegSetValueExW RegSetValueExA RegOpenKeyExA RegOpenKeyExW RegCreateKeyW RegDeleteValueW RegEnumValueW RegQueryValueExW RegCreateKeyA RegCloseKey

shell32

ShellExecuteExA Shell_NotifyIconA ExtractIconA ShellExecuteW

ole32

CoGetObject CoUninitialize CoInitializeEx

shlwapi

PathFileExistsW StrToIntA PathFileExistsA

winmm

waveInClose waveInStop waveInPrepareHeader waveInUnprepareHeader PlaySoundW waveInOpen waveInStart mciSendStringA waveInAddBuffer mciSendStringW

ws2_32

recv connect socket send WSAStartup WSAGetLastError gethostbyname WSASetLastError inet_addr gethostbyaddr getservbyport ntohs getservbyname htonl htons inet_ntoa closesocket

urlmon

URLDownloadToFileW URLOpenBlockingStreamW

gdiplus

GdipLoadImageFromStream GdipSaveImageToStream GdipGetImageEncodersSize GdiplusStartup GdipGetImageEncoders GdipCloneImage GdipAlloc GdipDisposeImage GdipFree

wininet

InternetOpenUrlW InternetOpenW InternetCloseHandle InternetReadFile

Name

.text

Size

419KB

Virtual Size

420KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

132KB

Virtual Size

132KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

4KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

23KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

351KB

Virtual Size

352KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

2026-08-09_a35b95ed914f77deee8748d3b1674a20_cobalt-strike_coinminer_icedid_njrat_remcos_vidar

kernel32

user32

gdi32

advapi32

shell32

ole32

shlwapi

winmm

ws2_32

urlmon

gdiplus

wininet

generic