remcos | Backdoor[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Backdoor.exe
Size 96KB
Sample260926-tsc9fafa65
SHA256 e78b7d1b1459fe25cc9944bea726e05cd2fe96bb63c01105fd94c30acadfc5f7
MD5 2813030734dd7a51f5c24d9585910a26
SHA1 ef1b7c0e5443d657ab9d73ce8ccc4ca1027a4134
SHA512 ecb57b073f2efaa9b77be21a8e365dc12885d5657860f01075fdc6404310029e8a1c65d7847e0a6cbd7f5c197ca29230e010cd195724ca613e3e53bb75f6c408
SSDEEP 1536:whhW0YTGZWdVseJxaM9kraLdV2QkQ1TbPX8IHOCkIsI4ESHNTh9E+JP19qkP6Ord:WhzYTGWVvJ8f2v1TbPzuMsIFSHNThy+b
TLSH
T199A3C617B94BD0A3E42591F186826BA18FBC7C333646213BD78FC9419DB8486D452EFA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

host rat remcos

Malware Config

Extracted

Family

remcos

Version

1.7 Pro

Botnet

Host

luck88com.net:443
luck88.video:443
xx8.cz:443
slot389.me:443
eurogonzo.me:443
fifa55ak.co:443
la-cmok.me:443
vanguardanalytics.co:443

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
5
copy_file
remcos.exe
copy_folder
remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
remcos_qvqthsofebfgtsv
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screens
screenshot_path
%AppData%
screenshot_time
1
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Backdoor.exe

File Explorer

Backdoor.exe

.exe 96KB

Backdoor.exe

IMPHASH d3a62971944197f0701c7049a9c739d1
SHA256 e78b7d1b1459fe25cc9944bea726e05cd2fe96bb63c01105fd94c30acadfc5f7
MD5 2813030734dd7a51f5c24d9585910a26
SHA1 ef1b7c0e5443d657ab9d73ce8ccc4ca1027a4134
SHA512 ecb57b073f2efaa9b77be21a8e365dc12885d5657860f01075fdc6404310029e8a1c65d7847e0a6cbd7f5c197ca29230e010cd195724ca613e3e53bb75f6c408
SSDEEP 1536:whhW0YTGZWdVseJxaM9kraLdV2QkQ1TbPX8IHOCkIsI4ESHNTh9E+JP19qkP6Ord:WhzYTGWVvJ8f2v1TbPzuMsIFSHNThy+b
TLSH
T199A3C617B94BD0A3E42591F186826BA18FBC7C333646213BD78FC9419DB8486D452EFA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

64904

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetModuleFileNameA GetLongPathNameA CreateMutexA OpenMutexA Process32Next Process32First CreateToolhelp32Snapshot SizeofResource LockResource LoadResource FindResourceA GetLocaleInfoA Process32NextW Process32FirstW lstrlenA GetDriveTypeA CreateProcessA GetTickCount GlobalUnlock GlobalLock GlobalAlloc WinExec GetCurrentProcessId CreateDirectoryW CopyFileA GetFileAttributesW GetLogicalDriveStringsA GetCurrentProcess ResumeThread SetThreadContext WriteProcessMemory VirtualAllocEx ReadProcessMemory GetThreadContext VirtualAlloc GlobalFree LocalAlloc TerminateProcess ReadFile PeekNamedPipe GetStdHandle CreatePipe OpenProcess DuplicateHandle GetCurrentThread lstrcpynA ExitProcess AllocConsole GetStartupInfoA ExpandEnvironmentStringsA FindFirstFileA FindNextFileA GetLastError LoadLibraryA GetProcAddress CreateFileMappingA MapViewOfFileEx DeleteFileA RemoveDirectoryA CloseHandle GetFileAttributesA SetFileAttributesA SetEvent TerminateThread FindFirstFileW FindNextFileW FindClose GetLocalTime CreateEventA WaitForSingleObject CreateDirectoryA ExitThread Sleep GetModuleHandleA DeleteFileW CreateThread

user32

GetWindowTextLengthA GetForegroundWindow UnhookWindowsHookEx CloseClipboard GetClipboardData OpenClipboard SetClipboardData EmptyClipboard ExitWindowsEx MessageBoxA GetKeyboardLayoutNameA GetWindowThreadProcessId ShowWindow CloseWindow GetWindowTextA GetWindowTextW EnumWindows SendInput CreateWindowExA RegisterClassExA AppendMenuA CreatePopupMenu TrackPopupMenu SetForegroundWindow GetCursorPos DefWindowProcA GetKeyState CallNextHookEx SetWindowsHookExA GetMessageA TranslateMessage GetKeyboardLayout FindWindowA DispatchMessageA IsWindowVisible

gdi32

CreateDCA CreateCompatibleDC GetDeviceCaps CreateCompatibleBitmap SelectObject StretchBlt GetObjectA GetDIBits DeleteObject DeleteDC

advapi32

OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegCreateKeyExA RegQueryInfoKeyA RegEnumKeyExA RegEnumValueA RegDeleteValueA RegCreateKeyA RegSetValueExA RegOpenKeyExA RegDeleteKeyA RegCloseKey RegQueryValueExA GetUserNameW

shell32

ShellExecuteA ExtractIconA Shell_NotifyIconA ShellExecuteExA ShellExecuteW

msvcp60

?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEPADXZ ?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEPADXZ ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@@Z ?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IIPBD@Z ??8std@@YA_NPBDABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z ??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z ??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV?$allocator@G@1@@Z ?find_last_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z ??9std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z ??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@G@Z ?substr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE?AV12@II@Z ?rfind@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIGI@Z ?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB ?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z ??0Init@ios_base@std@@QAE@XZ ??1Init@ios_base@std@@QAE@XZ ??0_Winit@std@@QAE@XZ ??1_Winit@std@@QAE@XZ ?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z ?find_last_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z ??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBGABV10@@Z ??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z ??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@DABV10@@Z ?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z ?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z ?begin@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ ?end@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ ?length@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ ??Bios_base@std@@QBEPAXXZ ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z ?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@IDABV?$allocator@D@1@@Z ??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z ??0?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAE@PBDH@Z ?is_open@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QBE_NXZ ?data@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ ??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z ??0logic_error@std@@QAE@ABV01@@Z ??0out_of_range@std@@QAE@ABV01@@Z ??1out_of_range@std@@UAE@XZ ??0out_of_range@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ ?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z ??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z ??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z ??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDIABV?$allocator@D@1@@Z ??_D?$basic_fstream@DU?$char_traits@D@std@@@std@@QAEXXZ ?close@?$basic_fstream@DU?$char_traits@D@std@@@std@@QAEXXZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBDH@Z ?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@JW4seekdir@ios_base@2@@Z ??0?$basic_fstream@DU?$char_traits@D@std@@@std@@QAE@PBDH@Z ??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z ??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@D@Z ?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ ??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z ?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB ?length@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ ??9std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z ?empty@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE_NXZ ??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z ?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIABV12@I@Z ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z ??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@0@Z ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z ??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ ?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ ??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@PBG@Z ?end@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ ?begin@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ ??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@G@Z ??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z ??_D?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ ?close@?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PADH@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@JW4seekdir@ios_base@2@@Z ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@H@2@XZ ?is_open@?$basic_ifstream@DU?$char_traits@D@std@@@std@@QBE_NXZ ??0?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAE@PBDH@Z ??_D?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ ?close@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ ??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z

msvcrt

_wrename _controlfp __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _acmdln _XcptFilter _exit _onexit __dllonexit ??1type_info@@UAE@XZ _iob freopen srand rand mbstowcs realloc _itoa sprintf getenv toupper tolower wcscmp printf strncmp malloc free _EH_prolog __CxxFrameHandler time localtime strftime puts atoi _ftol ??2@YAPAXI@Z _except_handler3 exit ??0exception@@QAE@ABV0@@Z _CxxThrowException

winmm

waveInOpen waveInStop waveInClose waveInAddBuffer waveInPrepareHeader waveInUnprepareHeader waveInStart

shlwapi

PathFileExistsA

ws2_32

htons gethostbyname closesocket socket send WSAGetLastError connect recv WSAStartup

urlmon

URLDownloadToFileA

gdiplus

GdipLoadImageFromStreamICM GdipDisposeImage GdipCloneImage GdipAlloc GdipSaveImageToStream GdipSaveImageToFile GdipLoadImageFromStream GdiplusStartup GdipGetImageEncoders GdipFree GdipGetImageEncodersSize

wininet

InternetCloseHandle InternetOpenUrlA InternetOpenA InternetReadFile