remcos | 2026-10-07_f8aace58d1168f68fc274f91a25a18d6_elex_parallax_remcos_remocs_wannacry

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-07_f8aace58d1168f68fc274f91a25a18d6_elex_parallax_remcos_remocs_wannacry
Size 111KB
Sample261008-apy7ysgt9w
SHA256 48a1ba637b4a85273db18a2a8d68236aebbd5008e06f117b73f7a29985417dea
MD5 f8aace58d1168f68fc274f91a25a18d6
SHA1 59dc5ab720ffa464db2451696e6862aa35dc6022
SHA512 1faf3c40df247321d0fdfb38aa01277757896db36a015a6d3943cf5c5dc5c6cbbe780ab9b7012845a62d4da673acf7e617bffced79573f14342fe63700f2aa0c
SSDEEP 3072:JuHq1twP/RbZwNDWB5noHMQ++PumNSFB44OzqhCcr:JuHqwP/FZwl6osQ++PumNSFBROzqhC
TLSH
T1EFB3E867E20B80A3D87302B056507B72EEBCBC321A5D5157E7E4D8811DF588E9066AFF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

tino rat remcos

Malware Config

Extracted

Family

remcos

Version

2.4.3 Pro

Botnet

TINo

185.140.53.140:2404

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
5
copy_file
remcos.exe
copy_folder
remcos
delete_file
true
hide_file
false
hide_keylog_file
true
install_flag
true
install_path
%AppData%
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-5S9O07
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
1
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

detects Windows exceutables potentially bypassing UAC using eventvwr.exe 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-07_f8aace58d1168f68fc274f91a25a18d6_elex_parallax_remcos_remocs_wannacry

File Explorer

2026-10-07_f8aace58d1168f68fc274f91a25a18d6_elex_parallax_remcos_remocs_wannacry

.exe 111KB

2026-10-07_f8aace58d1168f68fc274f91a25a18d6_elex_parallax_remcos_remocs_wannacry

IMPHASH e614da0834fa05db0c29913dd3f46013
SHA256 48a1ba637b4a85273db18a2a8d68236aebbd5008e06f117b73f7a29985417dea
MD5 f8aace58d1168f68fc274f91a25a18d6
SHA1 59dc5ab720ffa464db2451696e6862aa35dc6022
SHA512 1faf3c40df247321d0fdfb38aa01277757896db36a015a6d3943cf5c5dc5c6cbbe780ab9b7012845a62d4da673acf7e617bffced79573f14342fe63700f2aa0c
SSDEEP 3072:JuHq1twP/RbZwNDWB5noHMQ++PumNSFB44OzqhCcr:JuHqwP/FZwl6osQ++PumNSFBROzqhC
TLSH
T1EFB3E867E20B80A3D87302B056507B72EEBCBC321A5D5157E7E4D8811DF588E9066AFF
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

80292

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CreateMutexA OpenMutexA GetModuleHandleA Process32NextW Process32FirstW CreateToolhelp32Snapshot SizeofResource LockResource LoadResource FindResourceA GetLocaleInfoA OpenProcess GetCurrentProcessId lstrcatW GetTempFileNameW GetTempPathW GetTickCount GlobalUnlock GlobalLock GlobalAlloc CopyFileW ResumeThread SetThreadContext WriteProcessMemory VirtualAllocEx ReadProcessMemory GetThreadContext VirtualAlloc CreateProcessW GlobalFree LocalAlloc DuplicateHandle GetCurrentThread GetLongPathNameW lstrcpynA GetModuleFileNameA ExitProcess AllocConsole GetStartupInfoA ExpandEnvironmentStringsA FindFirstFileA FindNextFileA DeleteFileA GetLastError LoadLibraryA GetProcAddress CreateFileMappingA MapViewOfFileEx RemoveDirectoryW SetFileAttributesW TerminateThread FindClose GetLogicalDriveStringsA GetFileAttributesW DeleteFileW GetFileSize SetFilePointer GetDriveTypeA lstrlenA FindFirstFileW FindNextFileW CreatePipe CreateProcessA PeekNamedPipe ReadFile TerminateProcess SetEvent HeapCreate ExitThread HeapFree GetLocalTime CreateEventA WaitForSingleObject CreateThread GetModuleFileNameW Sleep CreateDirectoryW CreateFileW WriteFile CloseHandle GetCurrentProcess

user32

AppendMenuA RegisterClassExA CreateWindowExA SystemParametersInfoW SendInput GetIconInfo DrawIcon EnumWindows GetWindowTextW IsWindowVisible CloseWindow GetWindowThreadProcessId GetKeyboardLayoutNameA MessageBoxW ExitWindowsEx EmptyClipboard CreatePopupMenu ShowWindow SetWindowTextW SetForegroundWindow OpenClipboard GetClipboardData CloseClipboard UnhookWindowsHookEx GetForegroundWindow GetWindowTextLengthA GetWindowTextA GetKeyState CallNextHookEx SetWindowsHookExA GetKeyboardLayout GetMessageA TranslateMessage TrackPopupMenu GetCursorPos SetClipboardData DispatchMessageA DefWindowProcA

gdi32

CreateDCA CreateCompatibleDC GetDeviceCaps CreateCompatibleBitmap DeleteDC DeleteObject GetDIBits GetObjectA StretchBlt SelectObject

advapi32

RegOpenKeyExA RegEnumKeyExA GetUserNameW ChangeServiceConfigW QueryServiceStatus ControlService OpenSCManagerW StartServiceW OpenSCManagerA EnumServicesStatusW OpenServiceW RegDeleteKeyA RegCloseKey RegQueryValueExA RegQueryValueExW RegOpenKeyExW RegSetValueExA RegCreateKeyA RegSetValueExW RegCreateKeyW RegDeleteValueW RegEnumValueW RegEnumKeyExW RegQueryInfoKeyW RegCreateKeyExW AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken CloseServiceHandle QueryServiceConfigW

shell32

ExtractIconA Shell_NotifyIconA ShellExecuteExA ShellExecuteW

msvcrt

_controlfp _except_handler3 __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _acmdln _XcptFilter _exit ??1type_info@@UAE@XZ _onexit __dllonexit _iob freopen wcscat _itow srand swprintf _wsystem wcscpy wcslen _wgetenv toupper sprintf tolower wcscmp _wrename exit getenv printf strncmp malloc free _EH_prolog __CxxFrameHandler ??3@YAXPAX@Z _CxxThrowException ??0exception@@QAE@ABV0@@Z time localtime strftime atoi _ftol ??2@YAPAXI@Z rand _itoa

msvcp60

?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z ??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z ??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z ??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z ??8std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z ?size@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ ??_D?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ ?close@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ ??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z ??0?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAE@PBDH@Z ??8std@@YA_NPBGABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@@Z ?replace@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IIPBG@Z ?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGI@Z ?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@@Z ??8std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z ?find_last_of@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGI@Z ?find_last_of@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIGI@Z ??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z ?is_open@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QBE_NXZ ??0Init@ios_base@std@@QAE@XZ ??1Init@ios_base@std@@QAE@XZ ??0_Winit@std@@QAE@XZ ??1_Winit@std@@QAE@XZ ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIGI@Z ??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z ?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ ?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@IGABV?$allocator@G@1@@Z ?begin@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ ?end@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ ?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEPADXZ ?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z ?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXID@Z ?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEPADXZ ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGIABV?$allocator@G@1@@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@IDABV?$allocator@D@1@@Z ??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z ?empty@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE_NXZ ?begin@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ ?end@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z ?length@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ ?substr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE?AV12@II@Z ?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z ??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@G@Z ?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB ?rfind@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIGI@Z ?resize@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXI@Z ??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z ??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@D@Z ?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ??9std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z ??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z ??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z ??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@IIABV?$allocator@D@1@@Z ??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z ??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z ?empty@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE_NXZ ??9std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z ?length@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ ??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z ?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ ?data@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z ??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBGABV10@@Z ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB ?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIABV12@I@Z ?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z ??0out_of_range@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z ??1out_of_range@std@@UAE@XZ ??0out_of_range@std@@QAE@ABV01@@Z ??0logic_error@std@@QAE@ABV01@@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z ??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@G@Z ??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@0@Z ??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@PBG@Z ??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z ?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDIABV?$allocator@D@1@@Z ??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z ??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z ?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z ?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z ??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV?$allocator@G@1@@Z

shlwapi

PathFileExistsA PathFileExistsW StrToIntA

winmm

PlaySoundW mciSendStringA waveInStop waveInStart waveInClose waveInUnprepareHeader waveInPrepareHeader mciSendStringW waveInAddBuffer waveInOpen

ws2_32

htons gethostbyname closesocket inet_ntoa socket connect recv send WSAStartup

urlmon

URLDownloadToFileW URLOpenBlockingStreamW

gdiplus

GdipLoadImageFromStreamICM GdipLoadImageFromStream GdipDisposeImage GdipCloneImage GdipAlloc GdipSaveImageToStream GdipSaveImageToFile GdiplusStartup GdipGetImageEncoders GdipGetImageEncodersSize GdipFree

wininet

InternetCloseHandle InternetOpenUrlA InternetOpenA InternetReadFile