Remcos RAT

First observed in 2016, Remcos RAT gets its name from its purpose, which is remote control and surveillance software. Originally marketed as legitimate software for remote management of Microsoft Windows from XP onwards, this remote access trojan is regularly seen in phishing campaigns for its ability to thoroughly compromise an affected system.

Threat ID:: CC-3862
Category:: Trojan
Threat Severity:: Medium
Threat Vector:: Phishing, Vulnerability
Published:: 20 May 2021 3:44 PM

Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Affected platforms

The following platforms are known to be affected:

Versions: all supported

Microsoft Windows

Threat details

Introduction

Remcos is a remote access trojan (RAT) with a wide range of malicious functionality, such as closely monitoring user activities by recording audio and video content, capturing credentials, stealing digital currency, downloading additional payloads, and retrieving confidential data while avoiding detection and sandboxes.

Delivery

Remcos is usually delivered by a phishing lure that has embedded malicious XML code in a Microsoft Office document. Other attachments, including .zip files, RTF files, and PDFs, either contain or link to the malicious document. The code downloads and executes Remcos. Current trends are used in the message subject line, such as shipping messages at holidays, tax information before the tax due dates, and coronavirus warnings during the Covid-19 pandemic.

Other delivery mechanisms include exploiting vulnerabilities. Campaigns from 2018 began exploiting CVE-2017-0199 and CVE-2017-11882 to download Remcos. In cyber attacks observed in April and May of 2021, the development tool MSBuild was used as the source of fileless attack – a legitimate application being used to load malware directly into memory. The distribution of the MSBuild .proj files that pull Remcos into memory is still unknown at the time of publication.

Activities

After Remcos is executed, full control is given to the advanced persistent threat operator, allowing them to obtain audio, video, and screen captures, steal information from the clipboard, begin file discovery, upload/download files to/from a command and control server, log all keystrokes, evade sandboxes, inject itself into a process to hide itself, and add registry run keys to activate itself again upon reboot.

Remcos includes a command line interface for full remote control.

Remediation advice

To prevent and detect an infection, NHS Digital advises that:

Secure configurations are applied to all devices.
Security updates are applied at the earliest opportunity.
Tamper protection settings in security products are enabled where available.
Obsolete platforms are segregated from the rest of the network.
IT usage policies are reinforced by regular training to ensure all users know not to open unsolicited links or attachments.
Multi-factor authentication (MFA) and lockout policies are used where practicable, especially for administrative accounts.
Administrative accounts are only used for necessary purposes.
Remote administration services use strongly encrypted protocols and only accept connections from authorised users or locations.
Systems are continuously monitored, and unusual activity is investigated, so that a compromise of the network can be detected as early as possible.

Please note that NCSC maintains guidance for securely configuring a wide range of end user device (EUD) platforms. For further details refer to their end user device security guidance pages.

Indicators of compromise

Host Indicators

MD5 hashes

04fc0ca4062dd014d64dcb2fe8dbc966
11458b0259a54c0a8146e7c16d1595e4
23c5bc4a2e69c3f171561b524ceb4098
41c0bb6e89ad89af8eef7bec40d4acbb
42b21fef9742a35830c03f3ee199f2f8
4def35aedc86a946c13118e14127e0e9
73790d28f4f8f0f4c402da66c8dc393f
85c700ff566161c77a03f282fa48a246
b2e0d468b82b1de92829817b1292907e
b8e9ce084d9d49f565f850c59b003bcf
c87943cc7cf5618cb1b5c0aa59d90e14
cf45b793bc9ec86bfedfa165c01ede15
de2ff99ca086a8ad0f9b8027aef696ba
eb8b1d64429e00f2b3b49f886ee3b0b4
f174c03d177a04e81677e9c9a9eae0c8

SHA-1 hashes

1ce8d815703dc9bfce0053d3b1c27f2d9bcdff39
2364a75570bab29a5ef1e780bae03f0ff6935f57
8d8d80eeda3a2a4f33aba72db50affab5d265caf
e323565337e3703ed439b73a5790cdd06d42006e

SHA-256 hashes

01d4f90e8c11045800d77ea0b706071b0497ac874ac634f7bc35829eeda177c0
01d75f2dd7d3a8df8ec45ace0c433de4e9042c84773cb94952dcdaa91de53d4c
0340b84c0a3ca20f9c09e1a81c9e9cb561607e491fca652b07a196cd40138648
03db92dac329dcda5c70a0b18b25b998e36f5d7c4650398c9ec864c8dc28ec3b
0409e5a5a78bfe510576b516069d4119b45a717728edb1cd346f65cfb53b2de2
06aaccfece6cbee1fe3287ce2d6accd9b60931c585f54a4c400b280ced6567a3
07380d9df664ef6f998ff887129ad2ac7b11d0aba15f0d72b6e150a776c6a1ef
082a3c57ffec44191f71f8b170137a7d1c398b76fc93c5cdcb6714958d50f792
098fd9d5eb438af073651243c07bedcf9e1a1363f682bdefc124588d0cbf356a
0ba2cf704dbe7339815ab4fee0edbf52d7d077df8b865a13cdb2c5c41c8cae55
0bec16111e2199d4f62882cd59c2e3868b5c7539e64f5f3fb16dde94e2b4292e
0ebfbcbf8c35ff8cbf36e38799b5129c7b70c6895d5f11d1ab562a511a2ec76e
109486cc31d92c918d219b93721e3c17ed854ae2a73a9ff1a6fd0e796aebaf6b
1108ee1ba08b1d0f4031cda7e5f8ddffdc8883db758ca978a1806dae9aceffd1
1224fa13afd1f551b4400cf7c6e35da7d686824e3e9191ee8714d620660c5fbb
156de314051af6a265626676bc594b98d0eafbaa8e1470bd1126ca037d64dee5
17882008afd8cdeb44cab2798e6949e9556072f9d239c30c652bfa6938106123
18f461b274aa21fc27491173968ebe87517795f24732ce977ccea5f627b116f9
1b78b77b4f571548df7d7a7e324bfe38425b901663906d91d7c5ec110a333a07
1cc8f8b1487893b2b0ff118faa2333e1826ae1495b626e206ef108460d4f0fe7
1e5d5226acaeac5cbcadba1faab4567b4e46b2e6724b61f8c705d99af80ca410
2003cb7cc8d8262b7975fcf9a2a9eb2b1aa7de32a5baffd2383ec4c251316ec9
224009a766eef638333fa49bb85e2bb9f5428d2e61e83425204547440bb6f58d
23c5eda8a283e8570cdbbe07c11389c4085c0f0d239a27552f109506da0515c1
23c8a5964de8b6b8a3138e704e3884c4986f1d5896e03577c18f68f16e44c598
259c6c9f64c7d8a5ea07770ed04a94ef4266f115bee1211f4b0a161614f1caac
27dd5a3466e4bade2238aa7f6d5cb7015110ceb10ba00c1769e4bc44fe80bcb8
295bac213ab152f260641257bcb8ce5a53b79a2c8d06094447bc3e6cbd85a17c
2b64b66d72d33debb0f35f2b69998763acb9888655b8b5a912d0eb6dd5f3fa8e
2c620195dddbd080bff652a08fe7287023cb27ffe8418a2bbc478dad376b63b8
2f81f5483bbdd78d3f6c23ea164830ae263993f349842dd1d1e6e6d055822720
2fad5192692c080dd477ed2ba9b36585fe6b59dc3467232b172ed5f959c90b65
3102123a62009a62e4a75da567d6b65abd2de23c739cba7486dff4337927fec4
3352d1fe7f437010528fe4655f955435ecfe3dd3f42da020267c505e5c03bdf9
3772fcfbb09ec55b4e701a5e5b4c5c9182656949e6bd96bbd758947dfdfeba62
3b69867aabd0912ec4d46c50f059d60fe8a541f4b18a0bca5eac711e921cb00b
3c64ed631aa34dd243e321f39a0ad5ea40db7ad94152ce97e48c43bb52ed9fbd
3c67d3b92295c9f876ab657b76e92319868c6cdfee035e97597db8b5ef2ca9cc
3e2adc2b31db675bde5c51b93457cde98aa5df481dea548c3ea7b2eece2927c3
402517926305219d9d482063334b9955866fbeb7fadd5fe9e0f72cc04a112173
40784da7bd130c13b57f200f45174bde52d5cab25695ba259a0fa205514f823a
43282cb81e28bd2b7d4086f9ba4a3c538c3d875871bdcf881e58c6b0da017824
43fb57e3bb4dd2017de2c53b308a8bd4a98f580d12d38884a615a3501be2d9de
456067426d541f23350f326b9633499e0118c58ab7f3d18d5884f50278ce9365
46d09b0d1e490a489c5ca2fbdda61cdeb40862cfe8a8a18a024f752ee1f9176a
478ee337f4f4c014e7e20c1dac66af0739c6f8c4ab08eeca86087794ad0f6dc3
48dec6683bd806a79493c7d9fc3a1b720d24ad8c6db4141bbec77e2aebad1396
4938f6b52e34768e2834dfacbc6f1d577f7ab0136b01c6160dd120364a1f9e1a
4b3fc2f015b690f584a0dc27bf7684420aca336f46ac7d80c38758c0ab8b7902
4d2ef2080eb70826119c4c31f8a0fc70a83edb8f0555572964662cb19446d0ff
4d7dd643a61c24ffb6bfc000b01e6a87ff7d50f1cd8cc70ae24a814da672b4b1
4dda06c95f268ff8e9edb4d42da54534361b6c899e0717ed26a5cf6527325015
4e0bcef2b9251e2aaecbf6501c8df706bf449b0e12434873833c6091deb94f0e
4e55885791569c17891d8620a28b7563f441e0c80e875df828b33a5a006d544a
502c4c424c8f435254953c1d32a1f7ae1e67fb88ebd7a31594afc7278dcafde3
5140c2417ee88bda726af50114b0479ab3a8f181da04fa01f9f673f63ae81361
516b4d6f893fd8f5cc68945d4f8184780ee747368bf0184194771ee098404fb7
524acf303c0abbe4c98adc82d8c5c731c807bacca66d1733cfc98a9556c376ff
53c5366e9c8e85bf7c05fef9fd7a568c29f1873d240c66d1e1c09674f74a2441
54c6f757f25dafd4b641bc7c97e968bc3f104c50e6c7685e0306ec0c8b69004e
559b6a9797ae592030fc775ec95d30b8dd546811fcab3bd58ecbb078f64698f4
577d1da8642cce737b54a205f15c14badf78414b4f1ebad83830ddf22c1cbe1d
5a9fa1448bc90a7d8f5e6ae49284cd99120c2cad714e47c65192d339dad2fc59
5dff2df99ba4a0000f839a59356c24e7c24749b1e12640327b3ba4890e9ffc28
64483724fdd0ba596f1dcebdf178bb9c856c9b4f6990d8ca47706cc233c41bb0
66df6a842e1d121f873b546d2d34fad685deb244a6efb61ca74c0c84aadb4ddc
6a8e333328928f8497741e03ae829a86587b9005cccb2a33a6062c20cb759491
6cf0a7a74395ee41f35eab1cb9bb6a31f66af237dbe063e97537d949abdc2ae9
6e8033042ef900bbcb6dd4994b33f13e6b0b95c352db78c59abfbbd9671bbb31
6f1440db04ca84002aa175d0ee84e2cff140b6112e54a6f360df6e2405bf20c1
71f4ff98b5c43912e39c9b68c0ae1ed894903e94756f41cf5631445499356527
72578440a76e491e7f6c53e39b02bd041383ecf293c90538dda82e5d1417cad1
73f15b77fcecec7fe5aa1d12323b973aa228331e5cac271252ba85773f105fa8
76a774567ad0de6457fc9bd2db0bd2449a50e7c4c706a6670f35a36af2d075ef
77cf87134a04f759be3543708f0664b80a05bb8315acb19d39aaa519d1da8e92
78a855be6a92027bfe71c2172aa557f27f1b9ac5f9fad53d64ee9c0a5017205f
7b7f9c0f1d1c6515e7a5747ae0f32876eb4d089109547129673cd0cb2699d930
7b9f34fbbb87fe1084429de536aaac5f359df545ce0c9606bf5d60b9e4fb6a30
7c06540b8502809c7d07571abcd15251ee642b5e47c6f3eb35b773376769931b
80116d1b5a7b432c7f09b831ba04f3faaed996cff7384464ec13df41f4303242
80f6104926429d0109f63d8181997c1a9baac48a9386c617d3958321631e2f62
825bc14410b7d8c9e74aec56f4dc7b5e512dea6676583d5f0f98ff8762019409
825e1c58bb0be9371faab57df786e8b8045e40760a7b64e8cb9fe27a002933a1
8326d96a64605e869e86cd56c048460d8ad2e0f639cf8845fa802290a0e3b6ae
84fa28e2b009c2e65ee7c8e127638e5c5afe1bace9b6ed31a208ca312ac340e0
84fd7f835de57d55ee857e7574664119ec4e8b51cf7a32c343e25d80a24fa68c
8506e02b3869c95c7f4890277583f9f850c3d414136d2a87491e6e7d2b07c0a7
851950510f4760bded5792e8d8cfcbe2debf31c41b807e760495752d55674bc4
8710e87642371c828453d59c8cc4edfe8906a5e8fdfbf2191137bf1bf22ecf81
88d606ce0dd8e695a0cd4221475ce904e9c460f801a4aaf696df92cdf3357c8e
8a02ab410a448068bb0851fc06bd62e083d80f480a138112a751ad6828af59c1
8a93e978fdbfdf1e5c620d1d5c2cce5f37dcb767c46b6bd8f537795466fdedb6
8abcb3084bb72c1cb49aebaf0a0c221a40538a062a1b8830c1b48d913211a403
91032c5ddbb0447e1c772ccbe22c7966174ee014df8ada5f01085136426a0d20
9114a31330bb389fa242512ae4fd1ba0c9956f9bf9f33606d9d3561cc1b54722
92033ab41d0a52c21978eefbea86c9b4a68c89cf9cb281304430cf46672256f5
92f5bb456f3c0c9e3bdd9a5f429c73d874da1925d66bc853d5720d1cb6547257
94ff6d708820dda59738401ea10eb1b0d7d98d104a998ba6cee70e728eb5f29f
9633246f366d63cbc70eb14b3c50d58de41ffce75ba7685d82c185ecfdda5686
9717a2ec51316ca3b97d5c379e4b331e03e274dfd6de5433f3382b760f09b51b
990ccc084900c302273977c51d33e9f86c8be1275defa748942f2bfff855a381
9a333cba2e9357d5ae0991b8adffe43be6b9bc6186e5757d0b900e528f1b07cf
9c9d06228848ad875e8bdc680f4bd39f34ca4b2701692de767887ec4c11a32c1
9cccdb290dbbedfe54beb36d6359e711aee1b20f6b2b1563b32fb459a92d4b95
9ce43c6f333e122d3a01f4d182f01a6e3b0e904e3f642fccac640ac048cd154c
9fe46627164c0858ab72a7553cba32d2240f323d54961f77b5f4f59fe18be8fa
a37fb5d3be6c8db51f9d690533957612efc26cbdf52a7a012e8b1553f53a51cd
a49afa2cb3ca97f22b39f74a09249e26937bc73f40ef3a4047ea7a0298f71a08
a6d3232aeb2e3c6005036fb2777a3ce55cabf39ab8af66c09676852eae567193
a7dbf2a824931b9a7a7ed026e7f2482bc4588c2463b10c58ce08bb6213a9a5bb
a8662ef4e43e1a687536a40195b2ba2131ba88dd1e45a72237734f3a576f5c8a
a90179bf57c3af8f72f39187fb8ed454d987f9d9bb756d3ad9e45e672d69a403
a9c93dde254acdb091aca01eb000f18da1fe586dbd05e01dba572ec2bc294da6
aa7a3655dc5d9e0d69137cb8ba7cc18137eff290fde8c060ac678aa938f16ec7
abdcc6fbcd43d3c536d80127000ea469a4dc1c32ec819d32ab35ceb3070e0edd
ad78b68616b803243d56593e0fdd6adeb07bfc43d0715710a2c14417bba90033
af37a152c8605763868b29dbdfcc656514b815177982f40deb02315c83e68e24
b3fb560ffbd80ade545bd0f5b0f10526db4bf02b83db21283b65c63bf15cd85d
b45828548d894e2e2e78c7615e5441ebd199d0a4c31c684d54d49ba4321ac5af
b592be0c276387c4623cf0a847140a0d978de793a4d9fbb4813ed0f0fd37179d
b694796fc38e342bdf4593d134779a1e89d03159b563b6814e61962e0de5dc66
b728ce62518691276f5ddb21a18a0df40412abd8afbbc55903eccaa471b62a17
b78faefe577c3f09b35c6b4a81b1fd4c7d70154ab7589eda988be73d036e4866
bb3e5959a76a82db52840c4c03ae2d1e766b834553cfb53ff6123331f0be5d12
bb5b3a0ac4bdbaa62d08222dc2e5d871d88cf1a0755b2e715fea3fd6d24b3e65
bd60ca63e12af96922fe575119e3faa327a75ba588a3db59400ae6366799ce31
be485848a73ca50633d69b7ed7057db89900262d15bf20194cb24cf23f2571fd
c2307a9f18335967b3771028100021bbcf26cc66a0e47cd46b21aba4218b6f90
c51677bed0c3cfd27df7ee801da88241b659b2fa59e1c246be6db277ce8844d6
c56b3c8b69c1c378d677984f8bbef6d18873755ebdbe8bccb8f208be1179dc8c
c5b9c3a3bbfa89c83e1fb3955492044fd8bf61f7061ce1a0722a393e974cec7c
c75ba3917383a776dee26a215929d242b7896641a4157afa1d7d05913eb473fd
c99218e6a9577e3012522c7eac9f18197f517815f2c1ea63950c5ac205643055
c9c0180eba2a712f1aba1303b90cbf12c1117451ce13b68715931abc437b10cd
cd0cb55cdfadf33c66ad74cb1c03da7f661c5a99cbf090c60790d9543f36cb74
cd6caf2728bf88feefb6d388a56f60787e22b5f8b98d8041de47408b3133992b
ceacd96438f933acfbf6b01a34f37c36db4db79362f66d660fb6b33541581204
cee279204b9fc45dae530e1a4276ec6475d258e6e788e7c902fd066c5ec4cad0
cf624ccc3313f2cb5a55d3a3d7358b4bd59aa8de7c447cdb47b70e954ffa069b
d3612813abf81d0911d0d9147a5fe09629af515bdb361bd42bc5a79d845f928f
d525a3e1f20770000a6ec33a71a996c21b612b74d2be24d20a3f663f03e70d6f
da352ba8731afee3fdbca199ce8c8916a31283c07b2f4ebaec504bda2966892b
df0739f3988579942007024e55f8374444e7076b1e12adb285f800985d5f8ae9
e037f166b8e3066f5b8fc2f4dea6cf0d052dde5234b46c81e3d5ecf73dc713c2
e302fb178314aa574b89da065204bc6007d16c29f1dfcddcb3b1c90026cdd130
e38d44886a37f06ccc3b2dee2e063a521999fb207ec8ad519f099581ca80dd58
e64d41fb84a83432f460905f7fdecf6a704c1b58748bad2ddf328b5ba6a7d7e5
e67d9b689c50c9201ae26829ee0b9ef0a765f008c9fdf879827ad1b151f61f8b
e69d1b46b3d56fe9f1cbafbb1fe681581da4799c24aeb00e15bcdafbcb0217cd
e72ca0645ba6386b74d2d5414bed49fd3a8fb636446133064b850923abe6d518
e7c3c8195ff950b0d3f7e9c23c25bb757668b9c131b141528183541fc125d613
e87c200bfbd4def75783b5c18a468c36e770251daf0e7fe8a07da5ff678bd9ac
eaad66e48e3e3bf7c291baf791b910c7aab878b006cf37f653b152ec3118c0de
eb49b4f516251a86ef5d49ab634e25e7a1f88a1855cb46799081183048a844ee
eb8ddb4030665a4bee35306bb1a44d2faeb6e44c451d6ab4c7a39d105e396679
ed35017d51eb8779401b17d7bc5c840c73cf769c05c11db864d27f0c941c0365
ed788175ff97c12a87e7e966d45d0c1fd57d010c83ffc70ef9c91d8dff7641ea
ee0f3eb8a4d7c87a4c33a1f8b08e78bb95fa7ee41ddf0b07d9b6eabe87a33b2e
ef5e1af8b3e0f7f6658a513a6008cbfb83710f54d8327423db4bb65fa03d3813
f2c4e058a29c213c7283be382a2e0ad97d649d02275f3c53b67a99b262e48dd2
f6e67e072595431848b21cede36a4c46fc649f5da8fdf039a1da099bd0a53990
f7657176304f05b26f7646f6a4af9178e39dce032a8e8d32a554e7b5cd807641
fb76fd00cca6856d112a9a58f528bf0d566e425eddcdc6b3f5e167b5342c7fb2
fbb72fd701951c13d477de6f7ac1084db0617e458038f1dafe8ffac7c7f28190
fc0fa7c20adf0eaf0538cec14e37d52398a08d91ec105f33ea53919e7c70bb5a
fc50036f54d712b89e8f5f3a9de74a9a4ebf082af307091b61f6fc78449e54bb
fd00256c375f5d744d73a7ddba571f1887779af042bd6cf7100533c68c461a33
ff64d7dc2f60fd79304639393cf70fed82e3eb1395d9f331ba123bd4e5f75923

Files

AddInProcess32[.]exe
Boom[.]exe
C:\Users\<user>\AppData\Local\Macromedia\stikynot[.]exe
C:\Users\<username>\subfolder\filename1[.]vbs
C:\Users\<username>\subfolder\filename1[.]vbs
Esuerde[.]exe
.SettingContent[.]ms
Payment_output2ED76B0[.]exe
PcHealths[.]exe
Purchase order201900512[.]ace
remcos[.]ex$
%AppData%\Local\Temp\onedriv\logs[.]dat

Network indicators

IP addresses

108[.]170[.]10[.]24
109[.]232[.]227[.]138
135[.]181[.]170[.]169:50845
136[.]243[.]226[.]141
139[.]60[.]162[.]153
162[.]243[.]109[.]84
181[.]52[.]113[.]172
185[.]125[.]205[.]74
185[.]209[.]20[.]221
185[.]209[.]85[.]185
185[.]235[.]15[.]189
191[.]101[.]22[.]136
192[.]185[.]119[.]103
195[.]154[.]242[.]51
212[.]47[.]250[.]222
212[.]8[.]250[.]162
213[.]152[.]161[.]165
23[.]105[.]131[.]170
5[.]79[.]84[.]120
51[.]15[.]229[.]127
54[.]36[.]251[.]117
66[.]154[.]98[.]108
77[.]48[.]28[.]223
79[.]142[.]72[.]119
79[.]172[.]242[.]28
82[.]221[.]105[.]125
84[.]38[.]135[.]152
86[.]127[.]159[.]17
92[.]38[.]86[.]175

Domains

audioadapterplugin[.]chickenkiller[.]com
b1gdr34m5[.]warzonedns[.]com
businesslisting[.]igg[.]biz
civita2[.]no-ip[.]biz
computerdevices[.]freedns[.]tech
dboynyz[.]pdns[.]cz
google[.]airdns[.]org
lebontour[.]com
mdformo[.]ddns[.]net
mdformo1[.]ddns[.]net
mervinsaat[.]com[.]tr
midatacreditoexperian[.]com[.]co
ns1[.]madeinserverwick[.]club
paulocamarao[.]com
pimmas[.]com[.]tr
prince[.]jumpingcrab[.]com
rownip[.]3utilities[.]com
rownip[.]dyndnss[.]net
rownip[.]theworkpc[.]com
samurmakina[.]com[.]tr
santander-sm[.]co[.]uk
share[.]dmca[.]gripe
streetz[.]club
telebotdb[.]tk
timmason2[.]com
unifscon[.]com
uploadtops[.]is
vitlop[.]ddns[.]net

URLs

http://dl4[.]joxi[.]net/drive/2021/04/15/0048/3592/3153416/16/b8c104ce64[.]png
http://joxi[.]net/52ap4j7tkJER7m[.]proj

Email addresses

rud-division@alkuhaimi[.]com
service@santander-sm[.]co[.]uk

Last edited: 20 May 2021 4:47 pm