remcos | b97090dcb8cb09aa9976acd3ac2213ae7c9b88efcda68b39130b3a741308e5b4

General

Target
9820 #2109200-QY72190027-20261103.Pdf.lz
Size 682KB
Sample261103-phlqlsaa53
SHA256 b97090dcb8cb09aa9976acd3ac2213ae7c9b88efcda68b39130b3a741308e5b4
MD5 4d690b7f0f79ae9402efa909888b39e0
SHA1 73619430470c1016a2d458fbf8c92c45eb765592
SHA512 30cccb314ce19b42a232c36ee667176c6d20e8f99a198de4bc9f3c2591b9acff023daf7da7d9507cdabd1a1a38e57088c09b5d04b9284f6eb4b82038b79f23bc
SSDEEP 12288:Tk9QY7xc5y97oH72HJhldZevR3craTvTLAjrz6jQLp4qPWATbnKmffyXw/Jfb5fQ:47xc5yW+Za2r2vTGrm4pruebJiXw/JjK
TLSH
T12FE4337FE87EDDE66FC30008437CC5A0AB6409BA87C029055B11F577F69A2B93976E60
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

remcos

Version

7.3.1 Pro

Botnet

RemoteHost

C2

nelol2026.duckdns.org:32145

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
true
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-NAKEP0
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Targets

- Target
  9820 #2109200-QY72190027-20261103.Pdf.exe
- Size 762KB
- SHA256 18bd0b003e64fad26bbebf7ec27fd4aae71919c238756f147122f7562f828cf0
- MD5 92091b9bbabd6d73164ab306be276a0c
- SHA1 45d484a266456d77aa781ba753ddff2638e4ca04
- SHA512 6db1bb1625da89072dfb59dc7cc558d85f2077aa3847673408186bbb7ad960df2bbeb9a4589f1ec415d577e498cfb85cfe47e64464f95e06f915bac0e5a53390
- SSDEEP 12288:zN+C5hhfgEiaMNMMLcYvdDGY6vz2J5mwSwbjsqWz7P5tk8DsUExzfe:MYf9MNMMLnvdCDw5mwSysl/jKE
- TLSH
  T1F1F42335F7D278D9D0BD46768DB399129071BEBA053AA10B7601F93BBC386A0C53B358
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

remotehost defense_evasion remcos persistence rat
- Family: Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
  defense_evasion
behavioral1 behavioral2
- Target
  $PLUGINSDIR/Math.dll
- Size 36KB
- SHA256 d761e5e06e054f60b335d2d756c57909e6cac560db1afa74492f724a7c5709ba
- MD5 db5b3302875a95ce4a6049fb837617d7
- SHA1 3bfe838c3adf8ad4f007b19ae9d69e72ec3e4b34
- SHA512 4734930d41e12c95e47b39a4cc9a9ee95626f619c58de515cc919a50f1af540beb2788a688b6fc4d21046a62e3e7f0d5cb92cda2d9d5b2d7be4e57692ca20ec5
- SSDEEP 768:00jjHnaaIGBX/Dsv/B7coYfY7HVE/cu0Z/ivpvWKKKKKKKg7tEd:FRBX/Ds3BPB71Jqvpvm
- TLSH
  T160F21A27EAE184B9C49691BC67C7AD71B5F2BC090530D31E07A096503E6FE702F7AB85
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 27KB
- SHA256 d976014dab1c1ca93a8f94242a709fb16037f4b047d6ae51d56c9404544e8816
- MD5 c9b9b95558d7c44497637a376a3eb9e2
- SHA1 d3f988f792f5f80b551f9cef0ff3ad97a4712a30
- SHA512 8b615f38e740be03d0d1ed35e5268603efa428d26b56783ec88cf7f36f2f4f1e0f422fa1928abe677c72a78743cf3022040d157f46f7a980e9f330cc895cd0dd
- SSDEEP 768:xq2d6pSEIUzBHDG9iAZ/aR2RKKKKKKF91:F0D4S
- TLSH
  T160C2F8B7F7A2846DC087D278A6C6CBB2B4F1FC645430241E452176313F66AA49FBE2C5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6