remcos | 1d4affd51731348d6cc3ccf5e029ea7ab6acd37145f254831351588649873d20[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
1d4affd51731348d6cc3ccf5e029ea7ab6acd37145f254831351588649873d20.bin
Size 626KB
Sample260820-spms2azdmf
SHA256 1d4affd51731348d6cc3ccf5e029ea7ab6acd37145f254831351588649873d20
MD5 59d7c7cd3538a3474245fe939b593570
SHA1 6b19bd7ba26f57c92363ba818d07e1522db3613c
SHA512 61d310f1b851d279f38099809a73f0299c400c83914b0a134333d847f970e9ea730b17c38cc1db3e80a5fcb662534f7921a7a672ccf203866d3690508c45f903
SSDEEP 12288:CZL8K7flZQP2MfAeWoqOKpqs3+Jt6eJcJYYoF5Zr:cQKjlZQuaVWoqVpqsuJt6YcJYY05
TLSH
T142D47D4AA3A441F4D077C235CA838537E6B2BC056670862F13D74E5B6F273A15F2EB26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

remotehost rat remcos

Malware Config

Extracted

Family

remcos

Version

7.2.6 Pro

Botnet

RemoteHost

169.58.169.10:2404

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
true
install_flag
false
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-B7D7AY
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1d4affd51731348d6cc3ccf5e029ea7ab6acd37145f254831351588649873d20.bin

File Explorer

1d4affd51731348d6cc3ccf5e029ea7ab6acd37145f254831351588649873d20.bin

.exe 626KB

1d4affd51731348d6cc3ccf5e029ea7ab6acd37145f254831351588649873d20.bin

IMPHASH 0cc8e2c6f08a90a370d78009080edfef
SHA256 1d4affd51731348d6cc3ccf5e029ea7ab6acd37145f254831351588649873d20
MD5 59d7c7cd3538a3474245fe939b593570
SHA1 6b19bd7ba26f57c92363ba818d07e1522db3613c
SHA512 61d310f1b851d279f38099809a73f0299c400c83914b0a134333d847f970e9ea730b17c38cc1db3e80a5fcb662534f7921a7a672ccf203866d3690508c45f903
SSDEEP 12288:CZL8K7flZQP2MfAeWoqOKpqs3+Jt6eJcJYYoF5Zr:cQKjlZQuaVWoqVpqsuJt6YcJYY05
TLSH
T142D47D4AA3A441F4D077C235CA838537E6B2BC056670862F13D74E5B6F273A15F2EB26
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

301620

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetLogicalDriveStringsA SetFilePointerEx MoveFileW RemoveDirectoryW GetModuleHandleA TerminateThread GetFileSize ExpandEnvironmentStringsW GetEnvironmentVariableW MultiByteToWideChar GetModuleFileNameW CreateToolhelp32Snapshot Process32NextW Process32FirstW GetLongPathNameW CopyFileW InitializeCriticalSection GetLocaleInfoA VirtualProtect HeapFree SetLastError VirtualFree VirtualAlloc LoadLibraryA GetNativeSystemInfo HeapAlloc GetProcessHeap FreeLibrary IsBadReadPtr GetTempPathW OpenProcess lstrcatW GetCurrentProcessId GetTempFileNameW GlobalAlloc GlobalLock GetTickCount GlobalUnlock LocalAlloc GlobalFree MulDiv SizeofResource QueryDosDeviceW FindFirstVolumeW GetConsoleScreenBufferInfo SetConsoleTextAttribute lstrlenW GetStdHandle SetFilePointer FindResourceA FormatMessageW LockResource LoadLibraryW LoadResource LocalFree MoveFileExW FindVolumeClose GetVolumePathNamesForVolumeNameW DeleteFileW SetConsoleOutputCP FormatMessageA FindNextVolumeW AllocConsole lstrcmpW WriteProcessMemory Wow64SetThreadContext Wow64GetThreadContext GetThreadContext SetThreadContext ResumeThread GetModuleFileNameA lstrcpynA QueryPerformanceCounter DeleteCriticalSection SetEndOfFile HeapSize WriteConsoleW SetStdHandle SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExA HeapReAlloc ReadConsoleW GetConsoleMode GetConsoleCP FlushFileBuffers GetFileType GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW GetACP GetModuleHandleExW LoadLibraryExW RaiseException RtlPcToFileHeader RtlUnwindEx GetCPInfo GetStringTypeW GetLocaleInfoW LCMapStringW CompareStringW RtlUnwind DecodePointer DeleteFileA GetLastError SetFileAttributesW GetFileAttributesW FindClose lstrlenA GetDriveTypeA FindNextFileW GetFileSizeEx GetModuleHandleW FindFirstFileW ExitProcess GetProcAddress OpenMutexA CreateMutexA GetCurrentProcess CreateProcessA PeekNamedPipe CreatePipe TerminateProcess ReadFile CreateEventA GetLocalTime CreateThread SetEvent CreateEventW WaitForSingleObject Sleep CloseHandle ExitThread CreateFileW LeaveCriticalSection WriteFile EnterCriticalSection lstrcpyW CreateDirectoryW EncodePointer TlsFree TlsSetValue TlsGetValue TlsAlloc SwitchToThread WideCharToMultiByte InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext WaitForSingleObjectEx ResetEvent InitializeCriticalSectionAndSpinCount

user32

wsprintfW GetClipboardData UnhookWindowsHookEx GetForegroundWindow ToUnicodeEx GetKeyboardLayout SetWindowsHookExA CloseClipboard OpenClipboard GetKeyboardState CallNextHookEx GetKeyboardLayoutNameA GetKeyState GetWindowTextLengthW GetWindowThreadProcessId SetForegroundWindow SetClipboardData EnumWindows GetWindowTextW EmptyClipboard ShowWindow SetWindowTextW MessageBoxW IsWindowVisible CloseWindow SendInput EnumDisplaySettingsW mouse_event MapVirtualKeyA DrawIcon GetSystemMetrics GetIconInfo SystemParametersInfoW GetCursorPos RegisterClassExA AppendMenuA CreateWindowExA DefWindowProcA TrackPopupMenu GetMessageA DispatchMessageA TranslateMessage ExitWindowsEx CreatePopupMenu

gdi32

BitBlt CreateCompatibleBitmap SelectObject CreateCompatibleDC StretchBlt GetDIBits DeleteDC DeleteObject CreateDCA GetObjectA

advapi32

CryptAcquireContextA CryptGenRandom CryptReleaseContext GetUserNameW RegEnumKeyExA GetTokenInformation AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken RegQueryInfoKeyW RegQueryValueExA RegCreateKeyExW RegEnumKeyExW RegSetValueExW RegSetValueExA RegOpenKeyExA RegCreateKeyW RegDeleteValueW RegEnumValueW RegCreateKeyA RegDeleteKeyA RegCloseKey RegOpenKeyExW RegQueryValueExW

shell32

Shell_NotifyIconA ShellExecuteExA ShellExecuteW ExtractIconA

ole32

CoUninitialize CoGetObject CoInitializeEx

winmm

waveInOpen waveInUnprepareHeader waveInPrepareHeader waveInStop waveInStart waveInAddBuffer mciSendStringW mciSendStringA PlaySoundW waveInClose

ws2_32

socket connect recv send WSAGetLastError WSAStartup getaddrinfo inet_ntoa closesocket

urlmon

URLOpenBlockingStreamW URLDownloadToFileW

gdiplus

GdipLoadImageFromStream GdipDisposeImage GdipAlloc GdipSaveImageToStream GdipGetImageEncodersSize GdipCloneImage GdipGetImageEncoders GdiplusStartup GdipFree

wininet

InternetReadFile InternetCloseHandle InternetOpenW InternetOpenUrlW