remcos | 2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry
Size 1.6MB
Sample260820-eyrlpazbjg
SHA256 31fe600d3786c37b42ce407d2d9512a6542243ef7c6f55bc76f16d91889f88c7
MD5 b968e2a4603fbfe632e62630720a713d
SHA1 32fd2dba3c72e79db0840ca2ace1e73e21295159
SHA512 82e979cf40ca838b61939ae9a8ab6c7893f54156833eb3fedb0167c651f96770113cd4b76ef6dd6df9b34dc88e36a3b5413dd7de87bafc4467bd324ad3eafb78
SSDEEP 12288:INTm5FFykgJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFHA:IQbYkQdCN/j2GLl3iFSE33b9J
TLSH
T1EE751217FE57D1B3E41643B207947B22AF78ECB266298803C781D6C2EAB8D99D471533
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

qh88best.com rat remcos

Malware Config

Extracted

Family

remcos

Version

2.2.0 Light

Botnet

qh88best.com

qh88best.com:2404

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
3
copy_file
remcos.exe
copy_folder
remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-ONAWZB
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry

File Explorer

2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry

.exe 1.6MB

2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry

IMPHASH f79bdf7005a27b505da0a17f8329bd86
SHA256 31fe600d3786c37b42ce407d2d9512a6542243ef7c6f55bc76f16d91889f88c7
MD5 b968e2a4603fbfe632e62630720a713d
SHA1 32fd2dba3c72e79db0840ca2ace1e73e21295159
SHA512 82e979cf40ca838b61939ae9a8ab6c7893f54156833eb3fedb0167c651f96770113cd4b76ef6dd6df9b34dc88e36a3b5413dd7de87bafc4467bd324ad3eafb78
SSDEEP 12288:INTm5FFykgJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFHA:IQbYkQdCN/j2GLl3iFSE33b9J
TLSH
T1EE751217FE57D1B3E41643B207947B22AF78ECB266298803C781D6C2EAB8D99D471533
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

50436

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

FindResourceA GetLocaleInfoA Process32NextW Process32FirstW CreateToolhelp32Snapshot GetTickCount GlobalUnlock GlobalLock GlobalAlloc GetCurrentProcessId GetCurrentProcess DeleteFileA LoadResource LocalAlloc OpenProcess DuplicateHandle GetCurrentThread RemoveDirectoryW lstrcpynA GetModuleFileNameA ExitProcess AllocConsole GetStartupInfoA LockResource SizeofResource GetModuleHandleA CreateMutexA GetLastError GetLongPathNameW GetModuleFileNameW SetFileAttributesW LoadLibraryA GetProcAddress CreateFileMappingA MapViewOfFileEx TerminateThread FindClose ExitThread GetLogicalDriveStringsA GetFileAttributesW DeleteFileW CreateDirectoryW CreateFileW GetFileSize CreateThread SetFilePointer GetDriveTypeA lstrlenA FindFirstFileW FindNextFileW CreatePipe CreateProcessA PeekNamedPipe ReadFile WriteFile TerminateProcess SetEvent HeapCreate HeapFree Sleep GetLocalTime CreateEventA WaitForSingleObject CloseHandle GlobalFree

user32

SetForegroundWindow TrackPopupMenu CreatePopupMenu AppendMenuA RegisterClassExA CreateWindowExA SystemParametersInfoW GetForegroundWindow SendInput GetIconInfo DrawIcon EnumWindows GetCursorPos IsWindowVisible CloseWindow ShowWindow GetWindowThreadProcessId MessageBoxW ExitWindowsEx OpenClipboard EmptyClipboard SetClipboardData CloseClipboard GetClipboardData SetWindowTextW TranslateMessage GetWindowTextW DefWindowProcA DispatchMessageA GetMessageA

gdi32

GetDIBits GetObjectA StretchBlt SelectObject DeleteObject DeleteDC CreateCompatibleBitmap GetDeviceCaps CreateCompatibleDC CreateDCA

advapi32

RegCreateKeyW RegEnumKeyExA GetUserNameW ChangeServiceConfigW QueryServiceStatus ControlService OpenSCManagerW StartServiceW OpenSCManagerA EnumServicesStatusW OpenServiceW RegDeleteKeyA RegOpenKeyExA RegCloseKey RegQueryValueExA RegQueryValueExW RegOpenKeyExW RegSetValueExA RegCreateKeyA RegSetValueExW RegDeleteValueW RegEnumValueW RegEnumKeyExW RegQueryInfoKeyW RegCreateKeyExW AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken CloseServiceHandle QueryServiceConfigW

shell32

ExtractIconA Shell_NotifyIconA ShellExecuteExA ShellExecuteW

msvcrt

_controlfp _except_handler3 __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _acmdln _XcptFilter _exit ??1type_info@@UAE@XZ _onexit __dllonexit freopen wcscat _itow _wsystem sprintf wcscpy wcslen _wgetenv exit __CxxFrameHandler tolower wcscmp atoi _wrename ??2@YAPAXI@Z getenv ??3@YAXPAX@Z _CxxThrowException ??0exception@@QAE@ABV0@@Z printf strncmp malloc free _iob _itoa

msvcp60

??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGIABV?$allocator@G@1@@Z ??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z ??_D?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ ?close@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ ??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z ??0?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAE@PBDH@Z ?find_last_of@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGI@Z ?find_last_of@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIGI@Z ??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z ?is_open@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QBE_NXZ ??0Init@ios_base@std@@QAE@XZ ??1Init@ios_base@std@@QAE@XZ ??0_Winit@std@@QAE@XZ ??1_Winit@std@@QAE@XZ ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@IDABV?$allocator@D@1@@Z ?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ ?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@IGABV?$allocator@G@1@@Z ?begin@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ ?end@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ ?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEPADXZ ?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z ?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXID@Z ?empty@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE_NXZ ??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBGABV10@@Z ??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z ??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV?$allocator@G@1@@Z ?begin@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ ?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIABV12@I@Z ?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z ?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z ?length@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ ?substr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE?AV12@II@Z ?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB ?rfind@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIGI@Z ?resize@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXI@Z ??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@G@Z ??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z ??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@0@Z ??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@PBG@Z ??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@G@Z ??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z ??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@D@Z ?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ??9std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z ??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z ??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z ??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z ??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@IIABV?$allocator@D@1@@Z ??0out_of_range@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z ??1out_of_range@std@@UAE@XZ ??0out_of_range@std@@QAE@ABV01@@Z ??0logic_error@std@@QAE@ABV01@@Z ?end@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ ?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ ??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z ??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z ??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z ?empty@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE_NXZ ??9std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z ?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ ?data@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ ?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ ?length@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB ?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDIABV?$allocator@D@1@@Z ??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z ??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z

shlwapi

StrToIntA

ws2_32

htons socket send recv closesocket connect gethostbyname WSAStartup

urlmon

URLDownloadToFileW

gdiplus

GdipLoadImageFromStream GdipFree GdipDisposeImage GdipCloneImage GdipAlloc GdipSaveImageToStream GdiplusStartup GdipGetImageEncoders GdipGetImageEncodersSize GdipLoadImageFromStreamICM

wininet

InternetReadFile InternetOpenUrlA InternetOpenA InternetCloseHandle