remcos | 72e855025d02c02fa90b0ee9296d8a59a6c008dff1b70682b58474a8183836b5

General

Target
72e855025d02c02fa90b0ee9296d8a59a6c008dff1b70682b58474a8183836b5.exe
Size 795KB
Sample260810-rey8mswsa1
SHA256 72e855025d02c02fa90b0ee9296d8a59a6c008dff1b70682b58474a8183836b5
MD5 09406d8c037ab49a52afe0e1d6d0eaf9
SHA1 176cf51a8c84e358c1473b0b25ff7506a0a7e447
SHA512 401f95a16db9c793d29e007e05b082580dd37441666e3ca02c88c52658792a6b2f8614caee633b6f8c25911cf2427254c20ed01d7d88e514805755014aafa8ee
SSDEEP 24576:jyWZSQzRvZyAzSa6XX/m2q2ohF5UgVrR7:ulEZzzdivm2xohF5xN7
TLSH
T1BF05F11F66901757C9F6EE3181E2BB98AABB8D26275BC71347E0FF056D31EA80D801C5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

remcos

Version

7.2.5 Pro

Botnet

RemoteHost

C2

185.38.142.229:8787

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-I37T27
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Targets

- Target
  72e855025d02c02fa90b0ee9296d8a59a6c008dff1b70682b58474a8183836b5.exe
- Size 795KB
- SHA256 72e855025d02c02fa90b0ee9296d8a59a6c008dff1b70682b58474a8183836b5
- MD5 09406d8c037ab49a52afe0e1d6d0eaf9
- SHA1 176cf51a8c84e358c1473b0b25ff7506a0a7e447
- SHA512 401f95a16db9c793d29e007e05b082580dd37441666e3ca02c88c52658792a6b2f8614caee633b6f8c25911cf2427254c20ed01d7d88e514805755014aafa8ee
- SSDEEP 24576:jyWZSQzRvZyAzSa6XX/m2q2ohF5UgVrR7:ulEZzzdivm2xohF5xN7
- TLSH
  T1BF05F11F66901757C9F6EE3181E2BB98AABB8D26275BC71347E0FF056D31EA80D801C5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

remotehost discovery remcos persistence rat
- Family: Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
- MD5 6d08f0d5503bb100b8429fefaad163a6
- SHA1 2a79aac2d3b715326c3dcd3c5cf2e33de3632a0a
- SHA512 e259b1aff39c533e3e31cf4eb323c8eb22b2beeb5d8ce2c929de30702a6d8ab8076aeacc983d724b05d7d99a6de8c4d239bd159642c7e75fb86faef683360a1f
- SSDEEP 192:cjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZr0QPi:s/Qlt7wiij/lMRv/9V4brr
- TLSH
  T1A9427C1297B089F2F151093819667F2A6FBEAC5C23F405A3CFE304C63D212CB9879243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4