remcos | 87f16bb7b0ba473f44a0fed5b00587b15e379f6aa95b67d942852d59975473db

Sharing

Copy URL Twitter E-mail

General

Target
87f16bb7b0ba473f44a0fed5b00587b15e379f6aa95b67d942852d59975473db
Size 626KB
Sample260903-y3dp6sfj21
SHA256 87f16bb7b0ba473f44a0fed5b00587b15e379f6aa95b67d942852d59975473db
MD5 b098be3f6109d0ca6efe907f84aae7b8
SHA1 b69f6fac030aece1eab8c481a7143f0900f7344d
SHA512 468af70eebc04b1bd7adc634236a52aed7db96d234f6c0e568eac252c1cb20acf4dddd89067af87764e0a486efd7a64c4913be57da14348b9945974a448979c1
SSDEEP 12288:MZL8K7flZQP2MfAeWoqOKpqs3+Jt6eJcJYYoF5Zr:6QKjlZQuaVWoqVpqsuJt6YcJYY05
TLSH
T118D47D4AA3A441F4D077C235CA838537E6B2BC056670862F13D74E5B6F273A15F2EB26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

remcosremotehost rat remcos

Malware Config

Extracted

Family

remcos

Version

7.2.6 Pro

Botnet

RemcosRemoteHost

wowslot888.cc:8080
backdoor.wowslot888.cc:8080
malware.wowslot888.cc:8080
www.wowslot888.cc:8080
sitemap.wowslot888.cc:8080
webmail.wowslot888.cc:8080
api.wowslot888.cc:8080
c2.wowslot888.cc:8080

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
winservice.exe
copy_folder
service
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
true
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-H23D8O
screenshot_crypt
true
screenshot_flag
true
screenshot_folder
Screenshots
screenshot_path
%WinDir%\System32
screenshot_time
15
startup_value
take_screenshot_option
false
take_screenshot_time
5

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
87f16bb7b0ba473f44a0fed5b00587b15e379f6aa95b67d942852d59975473db

File Explorer

87f16bb7b0ba473f44a0fed5b00587b15e379f6aa95b67d942852d59975473db

.exe 626KB

87f16bb7b0ba473f44a0fed5b00587b15e379f6aa95b67d942852d59975473db

IMPHASH 0cc8e2c6f08a90a370d78009080edfef
SHA256 87f16bb7b0ba473f44a0fed5b00587b15e379f6aa95b67d942852d59975473db
MD5 b098be3f6109d0ca6efe907f84aae7b8
SHA1 b69f6fac030aece1eab8c481a7143f0900f7344d
SHA512 468af70eebc04b1bd7adc634236a52aed7db96d234f6c0e568eac252c1cb20acf4dddd89067af87764e0a486efd7a64c4913be57da14348b9945974a448979c1
SSDEEP 12288:MZL8K7flZQP2MfAeWoqOKpqs3+Jt6eJcJYYoF5Zr:6QKjlZQuaVWoqVpqsuJt6YcJYY05
TLSH
T118D47D4AA3A441F4D077C235CA838537E6B2BC056670862F13D74E5B6F273A15F2EB26
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

301620

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetLogicalDriveStringsA SetFilePointerEx MoveFileW RemoveDirectoryW GetModuleHandleA TerminateThread GetFileSize ExpandEnvironmentStringsW GetEnvironmentVariableW MultiByteToWideChar GetModuleFileNameW CreateToolhelp32Snapshot Process32NextW Process32FirstW GetLongPathNameW CopyFileW InitializeCriticalSection GetLocaleInfoA VirtualProtect HeapFree SetLastError VirtualFree VirtualAlloc LoadLibraryA GetNativeSystemInfo HeapAlloc GetProcessHeap FreeLibrary IsBadReadPtr GetTempPathW OpenProcess lstrcatW GetCurrentProcessId GetTempFileNameW GlobalAlloc GlobalLock GetTickCount GlobalUnlock LocalAlloc GlobalFree MulDiv SizeofResource QueryDosDeviceW FindFirstVolumeW GetConsoleScreenBufferInfo SetConsoleTextAttribute lstrlenW GetStdHandle SetFilePointer FindResourceA FormatMessageW LockResource LoadLibraryW LoadResource LocalFree MoveFileExW FindVolumeClose GetVolumePathNamesForVolumeNameW DeleteFileW SetConsoleOutputCP FormatMessageA FindNextVolumeW AllocConsole lstrcmpW WriteProcessMemory Wow64SetThreadContext Wow64GetThreadContext GetThreadContext SetThreadContext ResumeThread GetModuleFileNameA lstrcpynA QueryPerformanceCounter DeleteCriticalSection SetEndOfFile HeapSize WriteConsoleW SetStdHandle SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExA HeapReAlloc ReadConsoleW GetConsoleMode GetConsoleCP FlushFileBuffers GetFileType GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW GetACP GetModuleHandleExW LoadLibraryExW RaiseException RtlPcToFileHeader RtlUnwindEx GetCPInfo GetStringTypeW GetLocaleInfoW LCMapStringW CompareStringW RtlUnwind DecodePointer DeleteFileA GetLastError SetFileAttributesW GetFileAttributesW FindClose lstrlenA GetDriveTypeA FindNextFileW GetFileSizeEx GetModuleHandleW FindFirstFileW ExitProcess GetProcAddress OpenMutexA CreateMutexA GetCurrentProcess CreateProcessA PeekNamedPipe CreatePipe TerminateProcess ReadFile CreateEventA GetLocalTime CreateThread SetEvent CreateEventW WaitForSingleObject Sleep CloseHandle ExitThread CreateFileW LeaveCriticalSection WriteFile EnterCriticalSection lstrcpyW CreateDirectoryW EncodePointer TlsFree TlsSetValue TlsGetValue TlsAlloc SwitchToThread WideCharToMultiByte InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext WaitForSingleObjectEx ResetEvent InitializeCriticalSectionAndSpinCount

user32

wsprintfW GetClipboardData UnhookWindowsHookEx GetForegroundWindow ToUnicodeEx GetKeyboardLayout SetWindowsHookExA CloseClipboard OpenClipboard GetKeyboardState CallNextHookEx GetKeyboardLayoutNameA GetKeyState GetWindowTextLengthW GetWindowThreadProcessId SetForegroundWindow SetClipboardData EnumWindows GetWindowTextW EmptyClipboard ShowWindow SetWindowTextW MessageBoxW IsWindowVisible CloseWindow SendInput EnumDisplaySettingsW mouse_event MapVirtualKeyA DrawIcon GetSystemMetrics GetIconInfo SystemParametersInfoW GetCursorPos RegisterClassExA AppendMenuA CreateWindowExA DefWindowProcA TrackPopupMenu GetMessageA DispatchMessageA TranslateMessage ExitWindowsEx CreatePopupMenu

gdi32

BitBlt CreateCompatibleBitmap SelectObject CreateCompatibleDC StretchBlt GetDIBits DeleteDC DeleteObject CreateDCA GetObjectA

advapi32

CryptAcquireContextA CryptGenRandom CryptReleaseContext GetUserNameW RegEnumKeyExA GetTokenInformation AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken RegQueryInfoKeyW RegQueryValueExA RegCreateKeyExW RegEnumKeyExW RegSetValueExW RegSetValueExA RegOpenKeyExA RegCreateKeyW RegDeleteValueW RegEnumValueW RegCreateKeyA RegDeleteKeyA RegCloseKey RegOpenKeyExW RegQueryValueExW

shell32

Shell_NotifyIconA ShellExecuteExA ShellExecuteW ExtractIconA

ole32

CoUninitialize CoGetObject CoInitializeEx

winmm

waveInOpen waveInUnprepareHeader waveInPrepareHeader waveInStop waveInStart waveInAddBuffer mciSendStringW mciSendStringA PlaySoundW waveInClose

ws2_32

socket connect recv send WSAGetLastError WSAStartup getaddrinfo inet_ntoa closesocket

urlmon

URLOpenBlockingStreamW URLDownloadToFileW

gdiplus

GdipLoadImageFromStream GdipDisposeImage GdipAlloc GdipSaveImageToStream GdipGetImageEncodersSize GdipCloneImage GdipGetImageEncoders GdiplusStartup GdipFree

wininet

InternetReadFile InternetCloseHandle InternetOpenW InternetOpenUrlW