remcos | 5ed37cd2926e0cc732f311e4c9d8c5382213c1352ff3a64d2eac7291e7e5cb39

Sharing

Copy URL Twitter E-mail

General

Target
5ed37cd2926e0cc732f311e4c9d8c5382213c1352ff3a64d2eac7291e7e5cb39
Size 461KB
Sample261105-zdd53stsfs
SHA256 5ed37cd2926e0cc732f311e4c9d8c5382213c1352ff3a64d2eac7291e7e5cb39
MD5 85a079bd5091362799902b1c60f3e435
SHA1 7853953efdc363c88e8f9e83ee84cc536b1364fb
SHA512 ed235627f6a4a5ee16093620a4ef3159e0f3f55beb53f90f8dc3d834c44263501732689ddb4132011e52b35ef0dd22f7ab9b14e88fef3cd5581f1e1554963cf5
SSDEEP 12288:RND97qZOqjlNLdZb4AoNbCINfQhNg485x:/JOdjlNJZbHIShwx
TLSH
T115A49D22B491C032C17256701D2AFB3599FCBC312935597B77EA2D6ABE700D1B72A273
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

remcos rat remcos

Malware Config

Extracted

Family

remcos

Version

7.2.5 Light

Botnet

Remcos

127.0.0.1:2404

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-69GBIO
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5ed37cd2926e0cc732f311e4c9d8c5382213c1352ff3a64d2eac7291e7e5cb39

File Explorer

5ed37cd2926e0cc732f311e4c9d8c5382213c1352ff3a64d2eac7291e7e5cb39

.exe 461KB

5ed37cd2926e0cc732f311e4c9d8c5382213c1352ff3a64d2eac7291e7e5cb39

IMPHASH 34a5bdc697d0054f53a3adf12944ac9a
SHA256 5ed37cd2926e0cc732f311e4c9d8c5382213c1352ff3a64d2eac7291e7e5cb39
MD5 85a079bd5091362799902b1c60f3e435
SHA1 7853953efdc363c88e8f9e83ee84cc536b1364fb
SHA512 ed235627f6a4a5ee16093620a4ef3159e0f3f55beb53f90f8dc3d834c44263501732689ddb4132011e52b35ef0dd22f7ab9b14e88fef3cd5581f1e1554963cf5
SSDEEP 12288:RND97qZOqjlNLdZb4AoNbCINfQhNg485x:/JOdjlNJZbHIShwx
TLSH
T115A49D22B491C032C17256701D2AFB3599FCBC312935597B77EA2D6ABE700D1B72A273
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

214435

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

ExitProcess GetLocaleInfoA CreateToolhelp32Snapshot Process32NextW Process32FirstW VirtualProtect HeapFree SetLastError VirtualFree VirtualAlloc LoadLibraryA GetNativeSystemInfo HeapAlloc GetProcAddress GetProcessHeap FreeLibrary IsBadReadPtr GetCurrentProcess GlobalAlloc GlobalLock GetCurrentProcessId GetTickCount GlobalUnlock LocalAlloc GetModuleHandleA GlobalFree MulDiv SizeofResource QueryDosDeviceW FindFirstVolumeW GetConsoleScreenBufferInfo SetConsoleTextAttribute lstrlenW GetStdHandle RemoveDirectoryW FindResourceA OpenProcess FormatMessageW lstrcatW LockResource LoadLibraryW LoadResource LocalFree MoveFileExW GetFileSize FindVolumeClose CopyFileW GetVolumePathNamesForVolumeNameW lstrcpyW SetConsoleOutputCP FormatMessageA CreateMutexA AllocConsole lstrcmpW GetModuleHandleW GetModuleFileNameA lstrcpynA QueryPerformanceCounter EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection HeapSize ReadConsoleW WriteConsoleW SetStdHandle SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExA GetConsoleMode GetConsoleCP FlushFileBuffers GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale HeapReAlloc GetACP GetModuleHandleExW SetEndOfFile RtlUnwind GetModuleFileNameW GetLongPathNameW MultiByteToWideChar GetEnvironmentVariableW ExpandEnvironmentStringsW MoveFileW SetFilePointerEx GetLogicalDriveStringsA DeleteFileW GetLastError DeleteFileA SetFileAttributesW GetFileAttributesW CreateFileW FindClose lstrlenA GetDriveTypeA FindNextFileW GetFileSizeEx FindFirstFileW CreateDirectoryW CreateProcessA Sleep PeekNamedPipe CreatePipe TerminateProcess WriteFile ReadFile CreateEventA GetLocalTime CreateThread CloseHandle SetEvent CreateEventW FindNextVolumeW WaitForSingleObject RaiseException LoadLibraryExW GetCPInfo GetStringTypeW GetLocaleInfoW LCMapStringW CompareStringW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DecodePointer EncodePointer WideCharToMultiByte InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent WaitForSingleObjectEx ResetEvent

user32

SetForegroundWindow SetClipboardData GetClipboardData EnumWindows ExitWindowsEx EmptyClipboard CloseClipboard OpenClipboard ShowWindow SetWindowTextW MessageBoxW IsWindowVisible CloseWindow GetWindowThreadProcessId SendInput GetWindowTextW mouse_event MapVirtualKeyA DrawIcon GetSystemMetrics GetIconInfo SystemParametersInfoW GetForegroundWindow GetCursorPos RegisterClassExA AppendMenuA DefWindowProcA TrackPopupMenu CreatePopupMenu GetMessageA DispatchMessageA CreateWindowExA TranslateMessage EnumDisplaySettingsW

gdi32

CreateCompatibleBitmap SelectObject CreateCompatibleDC StretchBlt GetDIBits DeleteDC DeleteObject CreateDCA GetObjectA BitBlt

advapi32

CryptGenRandom CryptReleaseContext GetUserNameW RegEnumKeyExA GetTokenInformation AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken RegQueryInfoKeyW RegQueryValueExA RegCreateKeyExW RegEnumKeyExW RegSetValueExW RegSetValueExA RegOpenKeyExA RegCreateKeyW RegDeleteValueW RegEnumValueW RegCreateKeyA RegDeleteKeyA RegCloseKey RegOpenKeyExW RegQueryValueExW CryptAcquireContextA

shell32

Shell_NotifyIconA ShellExecuteExA ExtractIconA ShellExecuteW

winmm

PlaySoundW mciSendStringA mciSendStringW

ws2_32

WSAStartup closesocket getaddrinfo send WSAGetLastError recv connect socket

urlmon

URLDownloadToFileW URLOpenBlockingStreamW

gdiplus

GdipFree GdipSaveImageToStream GdipGetImageEncodersSize GdipLoadImageFromStream GdiplusStartup GdipGetImageEncoders GdipCloneImage GdipAlloc GdipDisposeImage

wininet

InternetReadFile InternetCloseHandle InternetOpenW InternetOpenUrlW

Name

.text

Size

333KB

Virtual Size

332KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

89KB

Virtual Size

88KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

1024B

Virtual Size

560B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

19KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

5ed37cd2926e0cc732f311e4c9d8c5382213c1352ff3a64d2eac7291e7e5cb39

kernel32

user32

gdi32

advapi32

shell32

winmm

ws2_32

urlmon

gdiplus

wininet

generic