remcos | b449b477af4d9600038d2f24f6beba5c92e4905ac3b69614a394afbf77e71f08

Sharing

Copy URL Twitter E-mail

General

Target
537821-WT3270921778-20261109.Pdf.exe
Size 784KB
Sample261109-nbbrdseg88
SHA256 b449b477af4d9600038d2f24f6beba5c92e4905ac3b69614a394afbf77e71f08
MD5 6aeefa466ba2e6c9b12b9d403d34633b
SHA1 71c2a689afdcf4615cd987645d1698ef69cb4166
SHA512 ceca241e64fae2bdc471f920d377283f0edca7d03aa9ec6f3955b36d462d4511e86c47fa34774aea88eb0a847056e0c19c2c3b3b97073fcaeb1735513cc67a42
SSDEEP 24576:JMOm5yyujRNXV7Z0LjhjMWM+sKGDa9V2Ip:2KyujRNF7ZsjhjZMdKGGZp
TLSH
T1EA051209FEC7B8EADEF541747EF6C1726311BCA84014925E16A8BE3F7D3A253C826904
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

remcos

Version

7.3.1 Pro

Botnet

RemoteHost

nelol2026.duckdns.org:32145

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
true
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-NAKEP0
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Targets

- Target
  537821-WT3270921778-20261109.Pdf.exe
- Size 784KB
- SHA256 b449b477af4d9600038d2f24f6beba5c92e4905ac3b69614a394afbf77e71f08
- MD5 6aeefa466ba2e6c9b12b9d403d34633b
- SHA1 71c2a689afdcf4615cd987645d1698ef69cb4166
- SHA512 ceca241e64fae2bdc471f920d377283f0edca7d03aa9ec6f3955b36d462d4511e86c47fa34774aea88eb0a847056e0c19c2c3b3b97073fcaeb1735513cc67a42
- SSDEEP 24576:JMOm5yyujRNXV7Z0LjhjMWM+sKGDa9V2Ip:2KyujRNF7ZsjhjZMdKGGZp
- TLSH
  T1EA051209FEC7B8EADEF541747EF6C1726311BCA84014925E16A8BE3F7D3A253C826904
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

remotehost defense_evasion remcos persistence rat
- Family: Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
  defense_evasion
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 25KB
- SHA256 29379ece432ccb81e22e57d7b5a8a77951c985495a931827f01771cf60b8b438
- MD5 9b3a5adad3c54468b976f683ef28aae4
- SHA1 e6ce3ed9fa51474ca560c41075be8cd52ae81e46
- SHA512 338ac47163f4c74af5c46318abf9d2a86febeeba4966ba2f3bcc5edc95ca373e253b3214fdcf349a13d431852b052d5910947ee9a63797ca4da0ba8333db4929
- SSDEEP 384:5Z2pfUx9eVLwDKO9XYD/isN7lCEjgwMU/ktKi+R45Duwomq8pqdDvHG1Q:5r96YIrx7lC7vU/kaG9uLmCdb
- TLSH
  T1A8B24C07F38398BFC50BC17186EF5772AA32BE211B616F6F1220F5756E24E90871DA14
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  $PLUGINSDIR/UserInfo.dll
- Size 7KB
- SHA256 e333cedc6a0c2c6aee171a7ed153b71a8fcc1b235664a2b38b0bed4f7a8be038
- MD5 3c662ed86938e5f318c331760c93c448
- SHA1 6c4dac8dc56e4750b340f04f2ec867dc081417ea
- SHA512 0f9f5a3f43b5b7da0791aa044e152200867d5e4070b312758680e266f83c567213828a402e33d34164b8beb4d9376d57d05ee67e031a140fa526426726c55fe6
- SSDEEP 96:USn/gFO2o+dVP9xwHs0VdKXSY7JeLn7vlH/4RQu7lH:rYJVP+3KXSdn799u
- TLSH
  T16BE1A78BB381696AC99AF6BC84FF2D2238777C301627161E980155663D346D2F735F0A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 14KB
- SHA256 e336c0f91eb419a3006c79683fe24bd6aaefb2e256153ef5b1525c723fc86f46
- MD5 71940cc9971044cfd95b6f83259281b4
- SHA1 249570d939797524713efefc93faa65b1ea8b297
- SHA512 d3f415bde982249bba11199c10517cbc6fc06d4dc607f256002d38aa41818576d4a51398078053a0f11d22e0cd3b0a280ec179221190a6f60464b004dd364eca
- SSDEEP 192:+ZWhF6MuqMgfdPvg/YWkNLiY8vSKXS6Hn5gIIblaks8NHAHWEdeqe4KFz0:YWh4MFv1w/YWCLXASKi6nAlHcAl4KW
- TLSH
  T18752191B7B42922ACD0AE374D5EF573322F3B4551138370E0669DB49BFE1660DA39288
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Debugger Evasion

T1622

Modify Registry

T1112

Credential Access

Discovery

Debugger Evasion

T1622

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Remcos

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8