remcos | 2026-09-30_0b8ff4064042fe86f9ea0a2f7f8061f5_amadey_coinminer_elex_luca-stealer_mespinoza_njrat_redline-stealer_remcos_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-30_0b8ff4064042fe86f9ea0a2f7f8061f5_amadey_coinminer_elex_luca-stealer_mespinoza_njrat_redline-stealer_remcos_smoke-loader
Size 438KB
Sample260930-red8ga1v9p
SHA256 77b20cf7d5d8d4f4983602ba2727e76f8772239537d716620689de270133e417
MD5 0b8ff4064042fe86f9ea0a2f7f8061f5
SHA1 8d3a25bdca32d67698f43d96de871c75e49f3f30
SHA512 b35286a8029385ffccc5877282c0e824d07257cd953bb09e59adaca8903b8570df4fa4a4cae1dd8d8cdf21a0ca3b8d7939f4cb8ff7cdc47afbdeec754a01cbb5
SSDEEP 6144:PG+qYQPZdFc5sEW6bRqNJndD3maYsXO/o88zMdAOSh26XuRcmngp:PHqYAdS/WVNrqaYsXGSEQh2Bbgp
TLSH
T118A4AE11B892C436C17215301D2AFBB599FCBD202A31457B73EA1E9BBE700C1B73A667
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

remotehost rat remcos

Malware Config

Extracted

Family

remcos

Version

7.0.5 Light

Botnet

RemoteHost

151.57.155.22:2606

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-KA8PT0
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-30_0b8ff4064042fe86f9ea0a2f7f8061f5_amadey_coinminer_elex_luca-stealer_mespinoza_njrat_redline-stealer_remcos_smoke-loader

File Explorer

2026-09-30_0b8ff4064042fe86f9ea0a2f7f8061f5_amadey_coinminer_elex_luca-stealer_mespinoza_njrat_redline-stealer_remcos_smoke-loader

.exe 438KB

2026-09-30_0b8ff4064042fe86f9ea0a2f7f8061f5_amadey_coinminer_elex_luca-stealer_mespinoza_njrat_redline-stealer_remcos_smoke-loader

IMPHASH 4639ed78b26697a2bee5408a49051263
SHA256 77b20cf7d5d8d4f4983602ba2727e76f8772239537d716620689de270133e417
MD5 0b8ff4064042fe86f9ea0a2f7f8061f5
SHA1 8d3a25bdca32d67698f43d96de871c75e49f3f30
SHA512 b35286a8029385ffccc5877282c0e824d07257cd953bb09e59adaca8903b8570df4fa4a4cae1dd8d8cdf21a0ca3b8d7939f4cb8ff7cdc47afbdeec754a01cbb5
SSDEEP 6144:PG+qYQPZdFc5sEW6bRqNJndD3maYsXO/o88zMdAOSh26XuRcmngp:PHqYAdS/WVNrqaYsXGSEQh2Bbgp
TLSH
T118A4AE11B892C436C17215301D2AFBB599FCBD202A31457B73EA1E9BBE700C1B73A667
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

188424

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LoadLibraryA GetNativeSystemInfo HeapAlloc GetProcAddress GetProcessHeap FreeLibrary IsBadReadPtr GetCurrentProcess GetSystemDirectoryA GlobalAlloc GlobalLock GetCurrentProcessId GetTickCount GlobalUnlock LocalAlloc GetModuleHandleA GlobalFree MulDiv SizeofResource QueryDosDeviceW FindFirstVolumeW GetConsoleScreenBufferInfo SetConsoleTextAttribute lstrlenW GetStdHandle RemoveDirectoryW FindResourceA OpenProcess FormatMessageW lstrcatW LockResource LoadLibraryW LoadResource LocalFree GetFileSize FindVolumeClose GetVolumePathNamesForVolumeNameW lstrcpyW SetConsoleOutputCP FormatMessageA FindNextVolumeW AllocConsole lstrcmpW GetModuleHandleW VirtualAlloc GetModuleFileNameA lstrcpynA QueryPerformanceFrequency QueryPerformanceCounter EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection HeapSize WriteConsoleW SetStdHandle SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExA ReadConsoleW GetConsoleMode GetConsoleCP FlushFileBuffers GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale HeapReAlloc GetACP GetModuleHandleExW MoveFileExW RtlUnwind RaiseException LoadLibraryExW GetCPInfo VirtualFree SetLastError HeapFree VirtualProtect Process32FirstW Process32NextW CreateToolhelp32Snapshot GetLocaleInfoA WaitForSingleObject ExitProcess CreateMutexA GetModuleFileNameW GetLongPathNameW ExpandEnvironmentStringsA FindNextFileA FindFirstFileA MoveFileW SetFilePointerEx GetLogicalDriveStringsA DeleteFileW DeleteFileA GetLastError SetFileAttributesW GetFileAttributesW CreateFileW FindClose lstrlenA GetDriveTypeA FindNextFileW GetFileSizeEx FindFirstFileW CreateDirectoryW CreateProcessA Sleep PeekNamedPipe CreatePipe TerminateProcess WriteFile ReadFile CreateEventA GetLocalTime CreateThread CloseHandle SetEvent CreateEventW GetStringTypeW GetLocaleInfoW LCMapStringW CompareStringW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount MultiByteToWideChar DecodePointer EncodePointer WideCharToMultiByte InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent WaitForSingleObjectEx ResetEvent SetEndOfFile

user32

MessageBoxW IsWindowVisible CloseWindow TranslateMessage DispatchMessageA GetMessageA GetWindowTextW SetForegroundWindow SetClipboardData GetClipboardData EnumWindows ExitWindowsEx EmptyClipboard CloseClipboard OpenClipboard ShowWindow SetWindowTextW CreatePopupMenu TrackPopupMenu DefWindowProcA CreateWindowExA AppendMenuA GetWindowThreadProcessId SendInput EnumDisplaySettingsW mouse_event MapVirtualKeyA DrawIcon GetSystemMetrics GetIconInfo SystemParametersInfoW RegisterClassExA GetCursorPos GetForegroundWindow

gdi32

BitBlt SelectObject CreateCompatibleDC StretchBlt GetDIBits DeleteDC DeleteObject CreateDCA GetObjectA CreateCompatibleBitmap

advapi32

CryptAcquireContextA CryptGenRandom CryptReleaseContext GetUserNameW RegEnumKeyExA GetTokenInformation QueryServiceStatus CloseServiceHandle OpenSCManagerW OpenSCManagerA ControlService StartServiceW QueryServiceConfigW ChangeServiceConfigW OpenServiceW EnumServicesStatusW AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken RegQueryInfoKeyW RegQueryValueExA RegCreateKeyExW RegEnumKeyExW RegSetValueExW RegSetValueExA RegOpenKeyExA RegOpenKeyExW RegCreateKeyW RegDeleteValueW RegEnumValueW RegQueryValueExW RegCreateKeyA RegCloseKey RegDeleteKeyA

shell32

ShellExecuteExA Shell_NotifyIconA ExtractIconA ShellExecuteW

shlwapi

StrToIntA PathFileExistsA PathFileExistsW

winmm

PlaySoundW mciSendStringA mciSendStringW

ws2_32

ntohs getservbyport gethostbyaddr inet_addr WSASetLastError gethostbyname WSAGetLastError recv connect socket send WSAStartup closesocket htons htonl getservbyname inet_ntoa

urlmon

URLDownloadToFileW URLOpenBlockingStreamW

gdiplus

GdiplusStartup GdipGetImageEncoders GdipCloneImage GdipAlloc GdipDisposeImage GdipFree GdipGetImageEncodersSize GdipSaveImageToStream GdipLoadImageFromStream

wininet

InternetOpenUrlW InternetOpenW InternetCloseHandle InternetReadFile

Name

.text

Size

309KB

Virtual Size

308KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

91KB

Virtual Size

91KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

1024B

Virtual Size

560B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

19KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

2026-09-30_0b8ff4064042fe86f9ea0a2f7f8061f5_amadey_coinminer_elex_luca-stealer_mespinoza_njrat_redline-stealer_remcos_smoke-loader

kernel32

user32

gdi32

advapi32

shell32

shlwapi

winmm

ws2_32

urlmon

gdiplus

wininet

generic