remcos | 322e33b688c2b589f5b28fff6ce53a302dcd0d26c8df2bcc4f4831805f1ea9dd

General

Target
Doc 008895217718.exe
Size 1.2MB
Sample261028-h4mfpsav9s
SHA256 322e33b688c2b589f5b28fff6ce53a302dcd0d26c8df2bcc4f4831805f1ea9dd
MD5 266bd804bcfcfd5464f0555a88e03f81
SHA1 efa1f5520f15685c06f269fd0c20c78c0c6dc5cb
SHA512 68a2506eb139e875f9667df62fe42f893f431f3c73f0bfe821bf952d524cb9462c29e5495d3c3f727a50d365ed12fb9114c24ff0f27563b2042e0eaf2aaa4700
SSDEEP 24576:lfYhSGgJIPQ2geQRywBbt2bGYOWCxxSMv7LznoKhcC4VWkvq:RXGgJIPQ5RywRt2QSMv7LkTC4hv
TLSH
T1B24523123228CCA5E554077AC7BED5F207B9BE39E6544E078BF0FE513DB11A14A7B20A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

remcos

Version

7.3.1 Pro

Botnet

RemoteHost

C2

212.162.149.90:2404

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-2AOO3L
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Targets

- Target
  Doc 008895217718.exe
- Size 1.2MB
- SHA256 322e33b688c2b589f5b28fff6ce53a302dcd0d26c8df2bcc4f4831805f1ea9dd
- MD5 266bd804bcfcfd5464f0555a88e03f81
- SHA1 efa1f5520f15685c06f269fd0c20c78c0c6dc5cb
- SHA512 68a2506eb139e875f9667df62fe42f893f431f3c73f0bfe821bf952d524cb9462c29e5495d3c3f727a50d365ed12fb9114c24ff0f27563b2042e0eaf2aaa4700
- SSDEEP 24576:lfYhSGgJIPQ2geQRywBbt2bGYOWCxxSMv7LznoKhcC4VWkvq:RXGgJIPQ5RywRt2QSMv7LkTC4hv
- TLSH
  T1B24523123228CCA5E554077AC7BED5F207B9BE39E6544E078BF0FE513DB11A14A7B20A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

remotehost defense_evasion discovery remcos privilege_escalation rat
- Family: Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Loads dropped DLL
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtCreateThreadExHideFromDebugger
  defense_evasion
- Suspicious use of NtSetInformationThreadHideFromDebugger
  defense_evasion
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
- MD5 192639861e3dc2dc5c08bb8f8c7260d5
- SHA1 58d30e460609e22fa0098bc27d928b689ef9af78
- SHA512 6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc
- SSDEEP 192:ljHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZqE0QPi:R/Qlt7wiij/lMRv/9V4bfr
- TLSH
  T1B1427C1297B089F2F551493419667F2A6FBEAC5C13F405A3CFE304C63D212CB9839243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 89a82c4849c21dfe765052681e1fad02d2d7b13c8b5075880c52423dca72a912
- MD5 b7d61f3f56abf7b7ff0d4e7da3ad783d
- SHA1 15ab5219c0e77fd9652bc62ff390b8e6846c8e3e
- SHA512 6467c0de680fadb8078bdaa0d560d2b228f5a22d4d8358a1c7d564c6ebceface5d377b870eaf8985fbee727001da569867554154d568e3b37f674096bbafafb8
- SSDEEP 96:ooEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YMNqkzfFc:ooEvCu5e81785qHFcU0PuAw0uyyIFc
- TLSH
  T16A12F992E2A454B3C5D6523B35AA2F2DCBBD5329B0927C01C7738E4D393957A6E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6