remcos | 2026-10-30_5a1e9d259879d4ef47388ba6a738a122_coinminer_elex_luca-stealer_mespinoza_njrat_redline-stealer_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-30_5a1e9d259879d4ef47388ba6a738a122_coinminer_elex_luca-stealer_mespinoza_njrat_redline-stealer_remcos
Size 472KB
Sample261101-ch46qssset
SHA256 71bd747e46afc0da63f5b83e49c92cbd52194332d2d29a3d1fe85283ddd529c7
MD5 5a1e9d259879d4ef47388ba6a738a122
SHA1 7c08ffeca52f8da7e76e0e0f3294cbcf10450345
SHA512 baa4dbb8bfad1f02175154e7aa3aae0988d7325be7fc716d2a8cd596e1855680dfb3b52ad804d60aae5fa3d9a9e7da298ac8dd31817b16368e1ebff39a52208c
SSDEEP 12288:yLwI1Xhu1t2m29+9oNRffxPseNbBMBwh4BGXHw:N6hu1tU9+9mRfnMuhfA
TLSH
T1F5A49D12B9D1C031C17255301D2AFB719AFCBC311936597B73D92E6ABEB00D1A72A7A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

remotehost rat remcos

Malware Config

Extracted

Family

remcos

Version

7.3.1 Light

Botnet

RemoteHost

192.168.0.16:2404

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-CE6Y5C
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-30_5a1e9d259879d4ef47388ba6a738a122_coinminer_elex_luca-stealer_mespinoza_njrat_redline-stealer_remcos

File Explorer

2026-10-30_5a1e9d259879d4ef47388ba6a738a122_coinminer_elex_luca-stealer_mespinoza_njrat_redline-stealer_remcos

.exe 472KB

2026-10-30_5a1e9d259879d4ef47388ba6a738a122_coinminer_elex_luca-stealer_mespinoza_njrat_redline-stealer_remcos

IMPHASH d7b704e31d5fa713f86d76b6921cd8a3
SHA256 71bd747e46afc0da63f5b83e49c92cbd52194332d2d29a3d1fe85283ddd529c7
MD5 5a1e9d259879d4ef47388ba6a738a122
SHA1 7c08ffeca52f8da7e76e0e0f3294cbcf10450345
SHA512 baa4dbb8bfad1f02175154e7aa3aae0988d7325be7fc716d2a8cd596e1855680dfb3b52ad804d60aae5fa3d9a9e7da298ac8dd31817b16368e1ebff39a52208c
SSDEEP 12288:yLwI1Xhu1t2m29+9oNRffxPseNbBMBwh4BGXHw:N6hu1tU9+9mRfnMuhfA
TLSH
T1F5A49D12B9D1C031C17255301D2AFB719AFCBC311936597B73D92E6ABEB00D1A72A7A3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

223661

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

MultiByteToWideChar GetLongPathNameW GetModuleFileNameW CreateMutexA ExitProcess GetLocaleInfoA CreateToolhelp32Snapshot Process32NextW Process32FirstW VirtualProtect HeapFree SetLastError VirtualFree VirtualAlloc LoadLibraryA GetNativeSystemInfo HeapAlloc GetProcessHeap IsBadReadPtr GetCurrentProcess GlobalAlloc GlobalLock GetCurrentProcessId GetTickCount GlobalUnlock LocalAlloc GetModuleHandleA GlobalFree MulDiv SizeofResource QueryDosDeviceW FindFirstVolumeW GetConsoleScreenBufferInfo SetConsoleTextAttribute lstrlenW GetStdHandle RemoveDirectoryW FindResourceA OpenProcess FormatMessageW lstrcatW LockResource LoadResource LocalFree MoveFileExW GetFileSize FindVolumeClose CopyFileW GetVolumePathNamesForVolumeNameW lstrcpyW SetConsoleOutputCP FormatMessageA GetEnvironmentVariableW AllocConsole lstrcmpW GetModuleHandleW GetModuleFileNameA lstrcpynA QueryPerformanceCounter EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection HeapSize ReadConsoleW WriteConsoleW SetStdHandle SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExA GetConsoleMode GetConsoleCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetFileType HeapReAlloc GetACP SetEndOfFile GetModuleHandleExW RtlUnwind ExpandEnvironmentStringsW WideCharToMultiByte FreeLibrary GetProcAddress LoadLibraryW MoveFileW SetFilePointerEx GetLogicalDriveStringsA DeleteFileW GetLastError DeleteFileA SetFileAttributesW GetFileAttributesW CreateFileW FindClose lstrlenA GetDriveTypeA FindNextFileW GetFileSizeEx FindFirstFileW CreateDirectoryW CreateProcessA Sleep PeekNamedPipe CreatePipe TerminateProcess WriteFile ReadFile CreateEventA GetLocalTime CreateThread CloseHandle SetEvent CreateEventW FindNextVolumeW WaitForSingleObject RaiseException LoadLibraryExW GetCPInfo GetStringTypeW GetLocaleInfoW LCMapStringW CompareStringW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DecodePointer EncodePointer InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent WaitForSingleObjectEx ResetEvent

user32

SetForegroundWindow SetClipboardData GetClipboardData EnumWindows ExitWindowsEx EmptyClipboard CloseClipboard OpenClipboard ShowWindow SetWindowTextW MessageBoxW IsWindowVisible CloseWindow GetWindowThreadProcessId SendInput GetWindowTextW mouse_event MapVirtualKeyA DrawIcon GetSystemMetrics GetIconInfo SystemParametersInfoW GetForegroundWindow GetCursorPos RegisterClassExA CreateWindowExA DefWindowProcA TrackPopupMenu CreatePopupMenu GetMessageA DispatchMessageA AppendMenuA TranslateMessage EnumDisplaySettingsW

gdi32

CreateCompatibleBitmap SelectObject CreateCompatibleDC StretchBlt GetDIBits DeleteDC DeleteObject CreateDCA GetObjectA BitBlt

advapi32

CryptGenRandom CryptReleaseContext GetUserNameW RegEnumKeyExA GetTokenInformation AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken RegQueryInfoKeyW RegQueryValueExA RegCreateKeyExW RegEnumKeyExW RegSetValueExW RegSetValueExA RegOpenKeyExA RegCreateKeyW RegDeleteValueW RegEnumValueW RegCreateKeyA RegDeleteKeyA RegCloseKey RegOpenKeyExW RegQueryValueExW CryptAcquireContextA

shell32

Shell_NotifyIconA ShellExecuteExA ExtractIconA ShellExecuteW

winmm

PlaySoundW mciSendStringA mciSendStringW

ws2_32

WSAStartup closesocket getaddrinfo send WSAGetLastError recv socket connect

urlmon

URLDownloadToFileW URLOpenBlockingStreamW

gdiplus

GdipLoadImageFromStream GdipSaveImageToStream GdipGetImageEncodersSize GdiplusStartup GdipGetImageEncoders GdipCloneImage GdipAlloc GdipDisposeImage GdipFree

wininet

InternetReadFile InternetCloseHandle InternetOpenW InternetOpenUrlW

Name

.text

Size

343KB

Virtual Size

343KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

89KB

Virtual Size

89KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

1024B

Virtual Size

640B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

19KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

2026-10-30_5a1e9d259879d4ef47388ba6a738a122_coinminer_elex_luca-stealer_mespinoza_njrat_redline-stealer_remcos

kernel32

user32

gdi32

advapi32

shell32

winmm

ws2_32

urlmon

gdiplus

wininet

generic