Score: | 100 |
Range: | 0 - 100 |
Whitelisted: | false |
Confidence: | 100% |
Name | Description | Attribution | Blogpost URLs | Link |
---|---|---|---|---|
Remcos, RemcosRAT | Remcos (acronym of Remote Control & Surveillance Software) is a commercial Remote Access Tool to remotely control computers.Remcos is advertised as legitimate software which can be used for surveillance and penetration testing purposes, but has been used in numerous hacking campaigns.Remcos, once installed, opens a backdoor on the computer, granting full access to the remote user.Remcos is developed by the cybersecurity company BreakingSecurity. |
|
|
AV Detection |
---|
Source: |
Avira: |
Source: |
URL Reputation: |
||
Source: |
URL Reputation: |
Source: |
Malware Configuration Extractor: |
Source: |
File source: |
||
Source: |
File source: |
||
Source: |
File source: |
||
Source: |
File source: |
||
Source: |
File source: |
||
Source: |
File source: |
||
Source: |
File source: |
||
Source: |
File source: |
Source: |
Joe Sandbox ML: |
Source: |
Code function: |
0_2_00433837 |
Source: |
Binary or memory string: |
memstr_e5d48ee3-3 |
Exploits |
---|
Source: |
File source: |
||
Source: |
File source: |
||
Source: |
File source: |
||
Source: |
File source: |
||
Source: |
File source: |
||
Source: |
File source: |
Privilege Escalation |
---|
Source: |
Code function: |
0_2_004074FD |
Source: |
Static PE information: |
Source: |
Code function: |
0_2_00409253 | |
Source: |
Code function: |
0_2_0041C291 | |
Source: |
Code function: |
0_2_0040C34D | |
Source: |
Code function: |
0_2_00409665 | |
Source: |
Code function: |
0_2_0044E879 | |
Source: |
Code function: |
0_2_0040880C | |
Source: |
Code function: |
0_2_0040783C | |
Source: |
Code function: |
0_2_00419AF5 | |
Source: |
Code function: |
0_2_0040BB30 | |
Source: |
Code function: |
0_2_0040BD37 |
Source: |
Code function: |
0_2_00407C97 |
Networking |
---|
Source: |
Snort IDS: |
||
Source: |
Snort IDS: |
Source: |
URLs: |
Source: |
DNS query: |
Source: |
TCP traffic: |
Source: |
HTTP traffic detected: |
Source: |
IP Address: |
Source: |
ASN Name: |
Source: |
UDP traffic detected without corresponding DNS query: |
||
Source: |
UDP traffic detected without corresponding DNS query: |
Source: |
Code function: |
0_2_0041B380 |
Source: |
HTTP traffic detected: |
Source: |
DNS traffic detected: |
||
Source: |
DNS traffic detected: |
Source: |
String found in binary or memory: |
||
Source: |
String found in binary or memory: |
||
Source: |
String found in binary or memory: |
||
Source: |
String found in binary or memory: |
||
Source: |
String found in binary or memory: |
||
Source: |
String found in binary or memory: |
||
Source: |
String found in binary or memory: |
||
Source: |
String found in binary or memory: |
Key, Mouse, Clipboard, Microphone and Screen Capturing |
---|
Source: |
Code function: |
0_2_0040A2B8 |
Source: |
Windows user hook set: |
Jump to behavior |
Source: |
Code function: |
0_2_0040B70E |
Source: |
Code function: |
0_2_004168C1 |
Source: |
Code function: |
0_2_0040B70E |
Source: |
Code function: |
0_2_0040A3E0 |
E-Banking Fraud |
---|
Source: |
File source: |
||
Source: |
File source: |
||
Source: |
File source: |
||
Source: |
File source: |
||
Source: |
File source: |
||
Source: |
File source: |
||
Source: |
File source: |
||
Source: |
File source: |
Spam, unwanted Advertisements and Ransom Demands |
---|
Source: |
Code function: |
0_2_0041C9E2 |
System Summary |
---|
Source: |
Matched rule: |
||
Source: |
Matched rule: |
||
Source: |
Matched rule: |
||
Source: |
Matched rule: |
||
Source: |
Matched rule: |
||
Source: |
Matched rule: |
||
Source: |
Matched rule: |
||
Source: |
Matched rule: |
||
Source: |
Matched rule: |
||
Source: |
Matched rule: |
||
Source: |
Matched rule: |
||
Source: |
Matched rule: |
Source: |
Code function: |
0_2_004132D2 | |
Source: |
Code function: |
0_2_0041BB09 | |
Source: |
Code function: |
0_2_0041BB35 |
Source: |
Code function: |
0_2_004167B4 |
Source: |
Code function: |
0_2_0043E0CC | |
Source: |
Code function: |
0_2_0041F0FA | |
Source: |
Code function: |
0_2_00454159 | |
Source: |
Code function: |
0_2_00438168 | |
Source: |
Code function: |
0_2_004461F0 | |
Source: |
Code function: |
0_2_0043E2FB | |
Source: |
Code function: |
0_2_0045332B | |
Source: |
Code function: |
0_2_0042739D | |
Source: |
Code function: |
0_2_004374E6 | |
Source: |
Code function: |
0_2_0043E558 | |
Source: |
Code function: |
0_2_00438770 | |
Source: |
Code function: |
0_2_004378FE | |
Source: |
Code function: |
0_2_00433946 | |
Source: |
Code function: |
0_2_0044D9C9 | |
Source: |
Code function: |
0_2_00427A46 | |
Source: |
Code function: |
0_2_0041DB62 | |
Source: |
Code function: |
0_2_00427BAF | |
Source: |
Code function: |
0_2_00437D33 | |
Source: |
Code function: |
0_2_00435E5E | |
Source: |
Code function: |
0_2_00426E0E | |
Source: |
Code function: |
0_2_0043DE9D | |
Source: |
Code function: |
0_2_00413FCA | |
Source: |
Code function: |
0_2_00436FEA |
Source: |
Binary or memory string: |
||
Source: |
Binary or memory string: |
Source: |
Static PE information: |
Source: |
Matched rule: |
||
Source: |
Matched rule: |
||
Source: |
Matched rule: |
||
Source: |
Matched rule: |
||
Source: |
Matched rule: |
||
Source: |
Matched rule: |
||
Source: |
Matched rule: |
||
Source: |
Matched rule: |
||
Source: |
Matched rule: |
||
Source: |
Matched rule: |
||
Source: |
Matched rule: |
||
Source: |
Matched rule: |
Source: |
Classification label: |
Source: |
Code function: |
0_2_00417952 |
Source: |
Code function: |
0_2_0040F474 |
Source: |
Code function: |
0_2_0041B4A8 |
Source: |
Code function: |
0_2_0041AA4A |
Source: |
File created: |
Jump to behavior |
Source: |
Mutant created: |
Source: |
File created: |
Jump to behavior |
Source: |
Process created: |
Source: |
Command line argument: |
0_2_0040E9C5 | |
Source: |
Command line argument: |
0_2_0040E9C5 | |
Source: |
Command line argument: |
0_2_0040E9C5 | |
Source: |
Command line argument: |
0_2_0040E9C5 | |
Source: |
Command line argument: |
0_2_0040E9C5 | |
Source: |
Command line argument: |
0_2_0040E9C5 | |
Source: |
Command line argument: |
0_2_0040E9C5 | |
Source: |
Command line argument: |
0_2_0040E9C5 | |
Source: |
Command line argument: |
0_2_0040E9C5 | |
Source: |
Command line argument: |
0_2_0040E9C5 | |
Source: |
Command line argument: |
0_2_0040E9C5 | |
Source: |
Command line argument: |
0_2_0040E9C5 | |
Source: |
Command line argument: |
0_2_0040E9C5 | |
Source: |
Command line argument: |
0_2_0040E9C5 | |
Source: |
Command line argument: |
0_2_0040E9C5 | |
Source: |
Command line argument: |
0_2_0040E9C5 | |
Source: |
Command line argument: |
0_2_0040E9C5 | |
Source: |
Command line argument: |
0_2_0040E9C5 | |
Source: |
Command line argument: |
0_2_0040E9C5 | |
Source: |
Command line argument: |
0_2_0040E9C5 | |
Source: |
Command line argument: |
0_2_0040E9C5 | |
Source: |
Command line argument: |
0_2_0040E9C5 | |
Source: |
Command line argument: |
0_2_0040E9C5 | |
Source: |
Command line argument: |
0_2_0040E9C5 | |
Source: |
Command line argument: |
0_2_0040E9C5 | |
Source: |
Command line argument: |
0_2_0040E9C5 | |
Source: |
Command line argument: |
0_2_0040E9C5 | |
Source: |
Command line argument: |
0_2_0040E9C5 | |
Source: |
Command line argument: |
0_2_0040E9C5 | |
Source: |
Command line argument: |
0_2_0040E9C5 | |
Source: |
Command line argument: |
0_2_0040E9C5 | |
Source: |
Command line argument: |
0_2_0040E9C5 | |
Source: |
Command line argument: |
0_2_0040E9C5 | |
Source: |
Command line argument: |
0_2_0040E9C5 | |
Source: |
Command line argument: |
0_2_0040E9C5 | |
Source: |
Command line argument: |
0_2_0040E9C5 | |
Source: |
Command line argument: |
0_2_0040E9C5 | |
Source: |
Command line argument: |
0_2_0040E9C5 | |
Source: |
Command line argument: |
0_2_0040E9C5 |
Source: |
Static PE information: |
Source: |
File read: |
Jump to behavior |
Source: |
Key opened: |
Jump to behavior |
Source: |
Process created: |
|||
Source: |
Process created: |
|||
Source: |
Process created: |
Jump to behavior |
Source: |
Section loaded: |
Jump to behavior | ||
Source: |
Section loaded: |
Jump to behavior | ||
Source: |
Section loaded: |
Jump to behavior | ||
Source: |
Section loaded: |
Jump to behavior | ||
Source: |
Section loaded: |
Jump to behavior | ||
Source: |
Section loaded: |
Jump to behavior | ||
Source: |
Section loaded: |
Jump to behavior | ||
Source: |
Section loaded: |
Jump to behavior | ||
Source: |
Section loaded: |
Jump to behavior | ||
Source: |
Section loaded: |
Jump to behavior | ||
Source: |
Section loaded: |
Jump to behavior | ||
Source: |
Section loaded: |
Jump to behavior | ||
Source: |
Section loaded: |
Jump to behavior | ||
Source: |
Section loaded: |
Jump to behavior | ||
Source: |
Section loaded: |
Jump to behavior | ||
Source: |
Section loaded: |
Jump to behavior | ||
Source: |
Section loaded: |
Jump to behavior | ||
Source: |
Section loaded: |
Jump to behavior | ||
Source: |
Section loaded: |
Jump to behavior | ||
Source: |
Section loaded: |
Jump to behavior | ||
Source: |
Section loaded: |
Jump to behavior | ||
Source: |
Section loaded: |
Jump to behavior | ||
Source: |
Section loaded: |
Jump to behavior | ||
Source: |
Section loaded: |
Jump to behavior | ||
Source: |
Section loaded: |
Jump to behavior | ||
Source: |
Section loaded: |
Jump to behavior | ||
Source: |
Section loaded: |
Jump to behavior | ||
Source: |
Section loaded: |
Jump to behavior | ||
Source: |
Section loaded: |
Jump to behavior | ||
Source: |
Section loaded: |
Jump to behavior | ||
Source: |
Section loaded: |
Jump to behavior | ||
Source: |
Section loaded: |
Jump to behavior | ||
Source: |
Section loaded: |
Jump to behavior | ||
Source: |
Section loaded: |
Jump to behavior | ||
Source: |
Section loaded: |
Jump to behavior | ||
Source: |
Section loaded: |
Jump to behavior | ||
Source: |
Section loaded: |
Jump to behavior | ||
Source: |
Section loaded: |
Jump to behavior | ||
Source: |
Section loaded: |
Jump to behavior | ||
Source: |
Section loaded: |
Jump to behavior | ||
Source: |
Section loaded: |
Jump to behavior | ||
Source: |
Section loaded: |
Jump to behavior | ||
Source: |
Section loaded: |
Jump to behavior | ||
Source: |
Section loaded: |
Jump to behavior | ||
Source: |
Section loaded: |
Jump to behavior | ||
Source: |
Section loaded: |
Jump to behavior | ||
Source: |
Section loaded: |
Jump to behavior | ||
Source: |
Section loaded: |
Jump to behavior | ||
Source: |
Section loaded: |
Jump to behavior | ||
Source: |
Section loaded: |
Jump to behavior | ||
Source: |
Section loaded: |
Jump to behavior | ||
Source: |
Section loaded: |
Jump to behavior | ||
Source: |
Section loaded: |
Jump to behavior | ||
Source: |
Section loaded: |
Jump to behavior | ||
Source: |
Section loaded: |
Jump to behavior | ||
Source: |
Section loaded: |
Jump to behavior | ||
Source: |
Section loaded: |
Jump to behavior |
Source: |
Key value queried: |
Jump to behavior |
Source: |
Static PE information: |
||
Source: |
Static PE information: |
||
Source: |
Static PE information: |
||
Source: |
Static PE information: |
||
Source: |
Static PE information: |
||
Source: |
Static PE information: |
Source: |
Static PE information: |
Source: |
Static PE information: |
||
Source: |
Static PE information: |
||
Source: |
Static PE information: |
||
Source: |
Static PE information: |
||
Source: |
Static PE information: |
Source: |
Code function: |
0_2_0041CB50 |
Source: |
Code function: |
0_2_00457119 | |
Source: |
Code function: |
0_2_00457A46 | |
Source: |
Code function: |
0_2_00434E69 |
Source: |
Code function: |
0_2_00406EB0 |
Source: |
Code function: |
0_2_0041AA4A |
Hooking and other Techniques for Hiding and Protection |
---|
Source: |
File deleted: |
Jump to behavior |
Source: |
Code function: |
0_2_0041CB50 |
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior | ||
Source: |
Process information set: |
Jump to behavior |
Malware Analysis System Evasion |
---|
Source: |
Code function: |
0_2_0040F7A7 |
Source: |
Code function: |
0_2_0041A748 |
Source: |
Window found: |
Jump to behavior |
Source: |
Code function: |
0_2_00409253 | |
Source: |
Code function: |
0_2_0041C291 | |
Source: |
Code function: |
0_2_0040C34D | |
Source: |
Code function: |
0_2_00409665 | |
Source: |
Code function: |
0_2_0044E879 | |
Source: |
Code function: |
0_2_0040880C | |
Source: |
Code function: |
0_2_0040783C | |
Source: |
Code function: |
0_2_00419AF5 | |
Source: |
Code function: |
0_2_0040BB30 | |
Source: |
Code function: |
0_2_0040BD37 |
Source: |
Code function: |
0_2_00407C97 |
Source: |
Binary or memory string: |
||
Source: |
Binary or memory string: |
Source: |
API call chain: |
Source: |
Code function: |
0_2_004349F9 |
Source: |
Code function: |
0_2_0041CB50 |
Source: |
Code function: |
0_2_004432B5 |
Source: |
Code function: |
0_2_00412077 |
Source: |
Code function: |
0_2_004349F9 | |
Source: |
Code function: |
0_2_00434B47 | |
Source: |
Code function: |
0_2_0043BB22 | |
Source: |
Code function: |
0_2_00434FDC |
Source: |
Code function: |
0_2_004120F7 |
Source: |
Code function: |
0_2_00419627 |
Source: |
Process created: |
Jump to behavior |
Source: |
Binary or memory string: |
||
Source: |
Binary or memory string: |
||
Source: |
Binary or memory string: |
||
Source: |
Binary or memory string: |
||
Source: |
Binary or memory string: |
||
Source: |
Binary or memory string: |
||
Source: |
Binary or memory string: |
||
Source: |
Binary or memory string: |
||
Source: |
Binary or memory string: |
Source: |
Code function: |
0_2_00434C52 |
Source: |
Code function: |
0_2_0040F8D1 | |
Source: |
Code function: |
0_2_00452036 | |
Source: |
Code function: |
0_2_004520C3 | |
Source: |
Code function: |
0_2_00452313 | |
Source: |
Code function: |
0_2_00448404 | |
Source: |
Code function: |
0_2_0045243C | |
Source: |
Code function: |
0_2_00452543 | |
Source: |
Code function: |
0_2_00452610 | |
Source: |
Code function: |
0_2_004488ED | |
Source: |
Code function: |
0_2_00451CD8 | |
Source: |
Code function: |
0_2_00451F50 | |
Source: |
Code function: |
0_2_00451F9B |
Source: |
Code function: |
0_2_0041B7FF |
Source: |
Code function: |
0_2_0041B60D |
Source: |
Code function: |
0_2_00449190 |
Source: |
Key value queried: |
Jump to behavior |
Stealing of Sensitive Information |
---|
Source: |
File source: |
||
Source: |
File source: |
||
Source: |
File source: |
||
Source: |
File source: |
||
Source: |
File source: |
||
Source: |
File source: |
||
Source: |
File source: |
||
Source: |
File source: |
Source: |
Code function: |
0_2_0040BA12 |
Source: |
Code function: |
0_2_0040BB30 | |
Source: |
Code function: |
0_2_0040BB30 |
Remote Access Functionality |
---|
Source: |
Mutex created: |
Jump to behavior |
Source: |
File source: |
||
Source: |
File source: |
||
Source: |
File source: |
||
Source: |
File source: |
||
Source: |
File source: |
||
Source: |
File source: |
||
Source: |
File source: |
||
Source: |
File source: |
Source: |
Code function: |
0_2_0040569A |
IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
---|---|---|---|---|---|---|
85.60.29.68 | sendfiletiahforem.duckdns.org | Spain | 12479 | UNI2-ASES | true | |
178.237.33.50 | geoplugin.net | Netherlands | 8455 | ATOM86-ASATOM86NL | false |
Name | IP | Active |
---|---|---|
sendfiletiahforem.duckdns.org | 85.60.29.68 | true |
geoplugin.net | 178.237.33.50 | true |
Name | Malicious | Antivirus Detection | Reputation |
---|---|---|---|
true |
|
unknown | |
true |
|
unknown |