remcos | 8695db0045e87ccc6d93f10f1364a96f1ae851a7274d35a4d7f4defe069cccd4

Sharing

Copy URL Twitter E-mail

General

Target
8695db0045e87ccc6d93f10f1364a96f1ae851a7274d35a4d7f4defe069cccd4
Size 626KB
Sample260820-yscecsfe76
SHA256 8695db0045e87ccc6d93f10f1364a96f1ae851a7274d35a4d7f4defe069cccd4
MD5 24dba7e1a28f101346355248f433f072
SHA1 d0ede55eccdf8aeb10df0dab81e9a63e6b9b7b8b
SHA512 889e77f9c4805d3fcf874cd8db273a2d18851bf9c9a4936d70ad10b2d071ca78e301d663bfb41660bb7bb2e4a778062df79ccddbcf90b2a412097f2381d8a4e3
SSDEEP 12288:KZL8K7flZQP2MfAeWoqOKpqs3+Jt6eJcJYYoF5Zr:0QKjlZQuaVWoqVpqsuJt6YcJYY05
TLSH
T1B0D47D5AA3A441F4D077C235CA838537E6B2BC056670862F13D74E5B6F233A15F2EB26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

mu88remotehost rat remcos

Malware Config

Extracted

Family

remcos

Version

7.2.6 Pro

Botnet

MU88RemoteHost

admin.ilmlink.io:25
api.ilmlink.io:443
ilmlink.io:8082
c2.ilmlink.io:8080
exfil.ilmlink.io:8888
login.ilmlink.io:2223
panel.ilmlink.io:9999
phishing.ilmlink.io:3460
update.ilmlink.io:1604
www.ilmlink.io:2967

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
WinService.exe
copy_folder
service
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
true
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-0V3IH6
screenshot_crypt
false
screenshot_flag
true
screenshot_folder
Screenshots
screenshot_path
%WinDir%\System32
screenshot_time
5
startup_value
take_screenshot_option
false
take_screenshot_time
5

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8695db0045e87ccc6d93f10f1364a96f1ae851a7274d35a4d7f4defe069cccd4

File Explorer

8695db0045e87ccc6d93f10f1364a96f1ae851a7274d35a4d7f4defe069cccd4

.exe 626KB

8695db0045e87ccc6d93f10f1364a96f1ae851a7274d35a4d7f4defe069cccd4

IMPHASH 0cc8e2c6f08a90a370d78009080edfef
SHA256 8695db0045e87ccc6d93f10f1364a96f1ae851a7274d35a4d7f4defe069cccd4
MD5 24dba7e1a28f101346355248f433f072
SHA1 d0ede55eccdf8aeb10df0dab81e9a63e6b9b7b8b
SHA512 889e77f9c4805d3fcf874cd8db273a2d18851bf9c9a4936d70ad10b2d071ca78e301d663bfb41660bb7bb2e4a778062df79ccddbcf90b2a412097f2381d8a4e3
SSDEEP 12288:KZL8K7flZQP2MfAeWoqOKpqs3+Jt6eJcJYYoF5Zr:0QKjlZQuaVWoqVpqsuJt6YcJYY05
TLSH
T1B0D47D5AA3A441F4D077C235CA838537E6B2BC056670862F13D74E5B6F233A15F2EB26
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

301620

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetLogicalDriveStringsA SetFilePointerEx MoveFileW RemoveDirectoryW GetModuleHandleA TerminateThread GetFileSize ExpandEnvironmentStringsW GetEnvironmentVariableW MultiByteToWideChar GetModuleFileNameW CreateToolhelp32Snapshot Process32NextW Process32FirstW GetLongPathNameW CopyFileW InitializeCriticalSection GetLocaleInfoA VirtualProtect HeapFree SetLastError VirtualFree VirtualAlloc LoadLibraryA GetNativeSystemInfo HeapAlloc GetProcessHeap FreeLibrary IsBadReadPtr GetTempPathW OpenProcess lstrcatW GetCurrentProcessId GetTempFileNameW GlobalAlloc GlobalLock GetTickCount GlobalUnlock LocalAlloc GlobalFree MulDiv SizeofResource QueryDosDeviceW FindFirstVolumeW GetConsoleScreenBufferInfo SetConsoleTextAttribute lstrlenW GetStdHandle SetFilePointer FindResourceA FormatMessageW LockResource LoadLibraryW LoadResource LocalFree MoveFileExW FindVolumeClose GetVolumePathNamesForVolumeNameW DeleteFileW SetConsoleOutputCP FormatMessageA FindNextVolumeW AllocConsole lstrcmpW WriteProcessMemory Wow64SetThreadContext Wow64GetThreadContext GetThreadContext SetThreadContext ResumeThread GetModuleFileNameA lstrcpynA QueryPerformanceCounter DeleteCriticalSection SetEndOfFile HeapSize WriteConsoleW SetStdHandle SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExA HeapReAlloc ReadConsoleW GetConsoleMode GetConsoleCP FlushFileBuffers GetFileType GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW GetACP GetModuleHandleExW LoadLibraryExW RaiseException RtlPcToFileHeader RtlUnwindEx GetCPInfo GetStringTypeW GetLocaleInfoW LCMapStringW CompareStringW RtlUnwind DecodePointer DeleteFileA GetLastError SetFileAttributesW GetFileAttributesW FindClose lstrlenA GetDriveTypeA FindNextFileW GetFileSizeEx GetModuleHandleW FindFirstFileW ExitProcess GetProcAddress OpenMutexA CreateMutexA GetCurrentProcess CreateProcessA PeekNamedPipe CreatePipe TerminateProcess ReadFile CreateEventA GetLocalTime CreateThread SetEvent CreateEventW WaitForSingleObject Sleep CloseHandle ExitThread CreateFileW LeaveCriticalSection WriteFile EnterCriticalSection lstrcpyW CreateDirectoryW EncodePointer TlsFree TlsSetValue TlsGetValue TlsAlloc SwitchToThread WideCharToMultiByte InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext WaitForSingleObjectEx ResetEvent InitializeCriticalSectionAndSpinCount

user32

wsprintfW GetClipboardData UnhookWindowsHookEx GetForegroundWindow ToUnicodeEx GetKeyboardLayout SetWindowsHookExA CloseClipboard OpenClipboard GetKeyboardState CallNextHookEx GetKeyboardLayoutNameA GetKeyState GetWindowTextLengthW GetWindowThreadProcessId SetForegroundWindow SetClipboardData EnumWindows GetWindowTextW EmptyClipboard ShowWindow SetWindowTextW MessageBoxW IsWindowVisible CloseWindow SendInput EnumDisplaySettingsW mouse_event MapVirtualKeyA DrawIcon GetSystemMetrics GetIconInfo SystemParametersInfoW GetCursorPos RegisterClassExA AppendMenuA CreateWindowExA DefWindowProcA TrackPopupMenu GetMessageA DispatchMessageA TranslateMessage ExitWindowsEx CreatePopupMenu

gdi32

BitBlt CreateCompatibleBitmap SelectObject CreateCompatibleDC StretchBlt GetDIBits DeleteDC DeleteObject CreateDCA GetObjectA

advapi32

CryptAcquireContextA CryptGenRandom CryptReleaseContext GetUserNameW RegEnumKeyExA GetTokenInformation AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken RegQueryInfoKeyW RegQueryValueExA RegCreateKeyExW RegEnumKeyExW RegSetValueExW RegSetValueExA RegOpenKeyExA RegCreateKeyW RegDeleteValueW RegEnumValueW RegCreateKeyA RegDeleteKeyA RegCloseKey RegOpenKeyExW RegQueryValueExW

shell32

Shell_NotifyIconA ShellExecuteExA ShellExecuteW ExtractIconA

ole32

CoUninitialize CoGetObject CoInitializeEx

winmm

waveInOpen waveInUnprepareHeader waveInPrepareHeader waveInStop waveInStart waveInAddBuffer mciSendStringW mciSendStringA PlaySoundW waveInClose

ws2_32

socket connect recv send WSAGetLastError WSAStartup getaddrinfo inet_ntoa closesocket

urlmon

URLOpenBlockingStreamW URLDownloadToFileW

gdiplus

GdipLoadImageFromStream GdipDisposeImage GdipAlloc GdipSaveImageToStream GdipGetImageEncodersSize GdipCloneImage GdipGetImageEncoders GdiplusStartup GdipFree

wininet

InternetReadFile InternetCloseHandle InternetOpenW InternetOpenUrlW