a6676403beaaab3f9d782994881b12bcd76a67f1eda2ad9e981a608469182ad6
Remcos RAT with keylogger and credential theft
Remcos native RAT agent with remote file taskingNative RAT downloads, executes, and uploads controller-tasked files
SHA-256a6676403beaaab3f9d782994881b12bcd76a67f1eda2ad9e981a608469182ad6
Evidence
⋯7 more rows
0x86860f030083c4188d45f0508d45a8505757.......E.P.E.PWW
0x86966800000008575757685889460068dc89h....WWWhX.F.h..
0x86a64600ff15cca24500ff75f08b35fca245F.....E..u..5..E
⋯15 more rows
⋯4 more rows
0x59ff000000000000000000000000000000000................
0x5a000542a0700902b07007e2b0700682b0700T*...+..~+..h+..
0x5a010582b0700482b0700322b07001c2b0700X+..H+..2+...+..
0x5a020062b0700f42a0700e22a0700d02a0700.+...*...*...*..
0x5a030c02a0700aa2a0700922a0700822a0700.*...*...*...*..
0x5a0406c2a0700262907003c2a0700282a0700l*..&)..<*..(*..
0x5a050142a0700002a0700ee290700de290700.*...*...)...)..
0x5a060cc290700ba290700aa2907009a290700.)...)...)...)..
0x5a0708a290700782907006829070054290700.)..x)..h)..T)..
0x5a08044290700362907000000000012290700D)..6).......)..
0x5a090f8280700e8280700c4280700b8280700.(...(...(...(..
0x5a0a0ac2807009c2807009028070082280700.(...(...(...(..
0x5a0b0d2280700000000009a200700aa200700.(....... ... ..
0x5a0c0c6200700dc200700ec20070008210700. ... ... ...!..
0x5a0d01a2107002c210700402107005c210700.!..,!..@!..\!..
0x5a0e06e210700802107008c2107009c210700n!...!...!...!..
0x5a0f0aa210700ba210700ca210700e0210700.!...!...!...!..
0x5a100ec210700fe2107000c2207001c220700.!...!..."..."..
0x5a1102c2207003a220700462207005c220700,"..:"..F"..\"..
0x5a120702207008622070094220700a2220700p"..."..."..."..
0x5a130b2220700c2220700d8220700e8220700."..."..."..."..
0x5a140fc220700102307002423070032230700."...#..$#..2#..
0x5a150402307004a2307005c2307006e230700@#..J#..\#..n#..
0x5a16082230700a0230700ba230700c6230700.#...#...#...#..
0x5a170d6230700e8230700f82307000a240700.#...#...#...$..
0x5a1801a2407002a2407003a24070046240700.$..*$..:$..F$..
0x5a1907a2007007c240700882407009e240700z ..|$...$...$..
0x5a1a0b0240700c2240700d2240700de240700.$...$...$...$..
0x5a1b0f4240700002507001c25070036250700.$...%...%..6%..
0x5a1c0a2320700923207008232070068320700.2...2...2..h2..
0x5a1d04e320700343207001a32070008320700N2..42...2...2..
0x5a1e0f6310700ea310700d8310700c4310700.1...1...1...1..
0x5a1f0b6310700a63107009431070084310700.1...1...1...1..
0x5a20070310700623107004831070032310700p1..b1..H1..21..
0x5a2101c3107000c310700fa300700e8300700.1...1...0...0..
0x5a220de300700c8300700ba300700a8300700.0...0...0...0..
0x5a230963007008a3007007e3007006c300700.0...0..~0..l0..
0x5a2405a3007004a3007003830070022300700Z0..J0..80.."0..
0x5a2501230070002300700f82f0700ea2f0700.0...0.../.../..
0x5a26068200700542007004020070034200700h ..T ..@ ..4 ..
0x5a27020200700062007009c1d0700f81f0700 ... ..........
0x5a280ea1f0700da1f070088200700c41f0700......... ......
0x5a290ae1f0700a21f0700961f0700861f0700................
0x5a2a0761f0700661f0700541f0700401f0700v...f...T...@...
⋯7 more rows
0x6856465436861740000000100000000000000eChat...........
0x68574636d642e6578650053797374656d4472cmd.exe.SystemDr
0x68584697665005c0000000a0000005265636five.\.......Reco
⋯18 more rows
0x686b45c004300680072006f006d0065002e00\.C.h.r.o.m.e...
0x686c46500780065000000000000005c004200e.x.e.......\.B.
0x686d4720061007600650053006f0066007400r.a.v.e.S.o.f.t.
0x686e477006100720065005c00420072006100w.a.r.e.\.B.r.a.
0x686f4760065002d00420072006f0077007300v.e.-.B.r.o.w.s.
0x68704650072005c004100700070006c006900e.r.\.A.p.p.l.i.
⋯3 more rows
0x6874465006e00000000003300000031000000e.n.....3...1...
0x68754300000004d000000737663686f73742e0...M...svchost.
0x687646578650020002d007300690064002000exe. .-.s.i.d. .
0x687742d006100630063006500700074006500-.a.c.c.e.p.t.e.
⋯7 more rows
⋯3 more rows
0x68e505b4631315d0000005b4631325d000000[F11]...[F12]...
0x68e600d0a5b456e64206f6620636c6970626f..[End of clipbo
0x68e706172645d0d0a0d0a000000005b437472ard]........[Ctr
0x68e806c2b565d0d0a5b546578742070617374l+V]..[Text past
0x68e9065642066726f6d20636c6970626f6172ed from clipboar
0x68ea0645d0d0a000000005d0000005b437472d]......]...[Ctr
0x68eb06c2b00005b416c744c5d00005b416c74l+..[AltL]..[Alt
0x68ec0525d00005b4374726c4c5d005b437472R]..[CtrlL].[Ctr
0x68ed06c525d000d0a5b456e64206f6620636clR]...[End of cl
0x68ee06970626f6172645d0d0a00000d0a5b54ipboard]......[T
0x68ef065787420636f7069656420746f20636cext copied to cl
0x68f006970626f6172645d0d0a00002a000000ipboard]....*...
0x68f105c417070446174615c4c6f63616c5c47\AppData\Local\G
0x68f206f6f676c655c4368726f6d655c557365oogle\Chrome\Use
0x68f307220446174615c44656661756c745c4cr Data\Default\L
0x68f406f67696e204461746100000055736572ogin Data...User
0x68f5050726f66696c65000a5b4368726f6d65Profile..[Chrome
0x68f602053746f7265644c6f67696e73206e6f StoredLogins no
0x68f707420666f756e645d000000000a5b4368t found].....[Ch
0x68f80726f6d652053746f7265644c6f67696erome StoredLogin
0x68f907320666f756e642c20636c6561726564s found, cleared
0x68fa0215d00005c417070446174615c4c6f63!]..\AppData\Loc
0x68fb0616c5c476f6f676c655c4368726f6d65al\Google\Chrome
0x68fc05c5573657220446174615c4465666175\User Data\Defau
0x68fd06c745c436f6f6b69657300000a5b4368lt\Cookies...[Ch
0x68fe0726f6d6520436f6f6b696573206e6f74rome Cookies not
0x68ff020666f756e645d000a5b4368726f6d65 found]..[Chrome
0x6900020436f6f6b69657320666f756e642c20 Cookies found,
0x69010636c6561726564215d0000005c417070cleared!]...\App
0x69020446174615c526f616d696e675c4d6f7aData\Roaming\Moz
0x69030696c6c615c46697265666f785c50726filla\Firefox\Pro
0x6904066696c65735c00000a5b46697265666ffiles\...[Firefo
0x69050782053746f7265644c6f67696e73206ex StoredLogins n
0x690606f7420666f756e645d0000002e000000ot found].......
0x690702e2e00005c6c6f67696e732e6a736f6e....\logins.json
0x69080000000005c6b6579332e646200000000....\key3.db....
⋯3 more rows
0x690c06f6b696573206e6f7420666f756e645dokies not found]
0x690d0000000005c636f6f6b6965732e73716c....\cookies.sql
0x690e0697465000a5b46697265666f7820636fite..[Firefox co
0x690f06f6b69657320666f756e642c20636c65okies found, cle
0x6910061726564215d00005c536f6674776172ared!]..\Softwar
0x69110655c4d6963726f736f66745c57696e64e\Microsoft\Wind
⋯7 more rows
0x6f1d87368636f726500007573657233320000shcore..user32..
0x6f1e84e74556e6d6170566965774f66536563NtUnmapViewOfSec
0x6f1f874696f6e00000000476c6f62616c4d65tion....GlobalMe
0x6f2086d6f7279537461747573457800000000moryStatusEx....
0x6f2184973576f77363450726f636573730000IsWow64Process..
0x6f228476574436f6d70757465724e616d6545GetComputerNameE
0x6f23878570000497355736572416e41646d69xW..IsUserAnAdmi
0x6f2486e0000005368656c6c33320053657450n...Shell32.SetP
0x6f258726f63657373444550506f6c69637900rocessDEPPolicy.
⋯5 more rows
0x6f2b8476574436f6e736f6c6557696e646f77GetConsoleWindow
0x6f2c8000000004e7453757370656e6450726f....NtSuspendPro
0x6f2d863657373000000004e74526573756d65cess....NtResume
0x6f2e850726f6365737300476574457874656eProcess.GetExten
0x6f2f86465645463705461626c65004970686cdedTcpTable.Iphl
0x6f3087061706900000000476574457874656epapi....GetExten
0x6f3186465645564705461626c6500436f6e76dedUdpTable.Conv
0x6f328657274536964546f537472696e675369ertSidToStringSi
0x6f3386441000041647661706933322e646c6cdA..Advapi32.dll
0x6f3480000000052746c476574436f6d707265....RtlGetCompre
0x6f3587373696f6e576f726b53706163655369ssionWorkSpaceSi
0x6f3687a65000052746c436f6d707265737342ze..RtlCompressB
0x6f378756666657200000052746c4465636f6duffer...RtlDecom
0x6f38870726573734275666665720061000000pressBuffer.a...
0x6f398434f4e4f555424000a09205f5f5f5f5fCONOUT$... _____
0x6f3a85f202020202020202020202020202020_
0x6f3b82020202020202020202020202020200a .
0x6f3c809285f5f5f5f5f205c20202020202020.(_____ \
0x6f3d820202020202020202020202020202020
0x6f3e82020202020200a09205f5f5f5f5f2920 .. _____)
0x6f3f8295f5f5f5f5f205f5f5f5f2020205f5f)_____ ____ __
0x6f4085f5f205f5f5f2020205f5f5f200a097c__ ___ ___ ..|
0x6f41820205f5f20202f7c205f5f5f207c2020 __ /| ___ |
0x6f42820205c202f205f5f5f29205f205c202f \ / ___) _ \ /
0x6f4385f5f5f290a097c207c20205c205c7c20___)..| | \ \|
0x6f4485f5f5f5f7c207c207c202820285f5f7c____| | | ( (__|
0x6f458207c5f7c207c5f5f5f207c0a097c5f7c |_| |___ |..|_|