MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 45e104696a11a2a22dad21ca1b9cf5456444f47130b059ca1952e7052264876d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemoteManipulator


Vendor detections: 10


Intelligence 10 IOCs 1 YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 45e104696a11a2a22dad21ca1b9cf5456444f47130b059ca1952e7052264876d
SHA3-384 hash: 46e46e7835e550f05cf64a968ee4e118c12b39c6f79edf97c4f4dfb996d14b2707227defc3c11cea0cb38827846d6bc1
SHA1 hash: 2c5aab7eea3ac86e543ec537d5b8149d4c9d15d7
MD5 hash: 773d1b7a96cc0fbba599e43eb8092592
humanhash: potato-helium-queen-angel
File name:45E104696A11A2A22DAD21CA1B9CF5456444F47130B05.exe
Download: download sample
Signature RemoteManipulator
Create hunting rule
File size:18'715'632 bytes
First seen:2022-08-07 23:22:24 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 19b321cb7a9ce31c90397152f38b67ea (29 x RemoteManipulator)
ssdeep 393216:77+HEoyBneMDHmIraWad0tyvpreOQ1YIJN/RQo1gEB0j:7aHEoyBegmoad0LONg5Qo2tj
TLSH T18B1733C3FBF00859E8BB577598F65F1C4A3AEDACAB74530D09D0F229647398208662D7
TrID 66.6% (.EXE) UPX compressed Win32 Executable (27066/9/6)
11.0% (.EXE) Win32 Executable (generic) (4505/5/1)
7.3% (.MZP) WinArchiver Mountable compressed Archive (3000/1)
4.9% (.EXE) OS/2 Executable (generic) (2029/13)
4.9% (.EXE) Generic Win/DOS Executable (2002/3)
File icon (PE):PE icon
dhash icon c0dacabacac0c244 (20 x RemoteManipulator)
Reporter abuse_ch
Tags:exe RemoteManipulator signed

Code Signing Certificate

Organisation:Remote Utilities LLC
Issuer:DigiCert SHA2 Assured ID Code Signing CA
Algorithm:sha256WithRSAEncryption
Valid from:2017-08-22T00:00:00Z
Valid to:2019-08-27T12:00:00Z
Serial number: 0fed37ee0dfa5482049fb1c395fee690
Intelligence: 5 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: 18166689ccd9e3fd7ac77ac9b8a3d8f1c0985b7475071436695bfce3613b4915
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform


Avatar
abuse_ch
RemoteManipulator C2:
194.132.81.201:5655

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
194.132.81.201:5655 https://threatfox.abuse.ch/ioc/841828/

Intelligence

File Origin
# of uploads :
1
# of downloads :
424
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
45E104696A11A2A22DAD21CA1B9CF5456444F47130B05.exe
Verdict:
No threats detected
Analysis date:
2022-08-07 23:24:22 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/fcee666f-4a9d-40ae-97d1-5e0b25ca8906

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
PUA.Win.Packer.Upx-4
Create hunting rule

PUA.Win.Packer.Exe-6
Create hunting rule

PUA.Win.Tool.RemoteUtilities-9869515-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Creating a window
Searching for synchronization primitives
Creating a file in the %temp% subdirectories
Creating a file
Launching a process
Modifying a system file
Creating a file in the Windows subdirectories
Creating a file in the Program Files subdirectories
Creating a process from a recently created file
Creating a service
Launching a service
Enabling autorun for a service
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware overlay packed
Link:
https://www.filescan.io/uploads/62f049720d534e6081724da6/reports/49398191-35a7-4113-b4fd-50c10986b46d/overview
Result
Verdict:
MALICIOUS
Malware family:
Remote Utilities RAT
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/73a610a0-5fbb-4ba8-ac6b-c848e92a4b03
Result
Threat name:
RMSRemoteAdmin, Remote Utilities
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/1047604
Signature
Changes security center settings (notifications, updates, antivirus, firewall)
Detected Remote Utilities RAT
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 680098 Sample: 45E104696A11A2A22DAD21CA1B9... Startdate: 08/08/2022 Architecture: WINDOWS Score: 60 44 Malicious sample detected (through community Yara rule) 2->44 46 Multi AV Scanner detection for submitted file 2->46 48 Detected Remote Utilities RAT 2->48 50 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 2->50 7 msiexec.exe 111 145 2->7         started        11 svchost.exe 2->11         started        13 svchost.exe 21 2->13         started        15 13 other processes 2->15 process3 dnsIp4 32 C:\Program Files (x86)\...\rutserv.exe, PE32 7->32 dropped 34 C:\Program Files (x86)\...\rfusclient.exe, PE32 7->34 dropped 36 en_server_stop_B60...E7A415B72132E14.exe, PE32 7->36 dropped 40 46 other files (none is malicious) 7->40 dropped 52 Detected Remote Utilities RAT 7->52 18 rfusclient.exe 3 7->18         started        20 msiexec.exe 7->20         started        22 rutserv.exe 7->22         started        28 2 other processes 7->28 54 Changes security center settings (notifications, updates, antivirus, firewall) 11->54 24 MpCmdRun.exe 11->24         started        56 Query firmware table information (likely to detect VMs) 13->56 42 127.0.0.1 unknown unknown 15->42 38 C:\Users\user\AppData\Local\Temp\...\host.msi, Composite 15->38 dropped 58 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 15->58 26 msiexec.exe 15->26         started        file5 signatures6 process7 process8 30 conhost.exe 24->30         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/45e104696a11a2a22dad21ca1b9cf5456444f47130b059ca1952e7052264876d/
Threat name:
Win32.Backdoor.RaBased
Create hunting rule
Status:
Malicious
First seen:
2022-08-05 08:24:54 UTC
File Type:
PE (Exe)
Extracted files:
71
AV detection:
6 of 26 (23.08%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ixqqi2lkcgrkelnnehfbxhhvivsej5drgcyftsqzkltqkiteq5wq._file
Verdict:
malicious
Result
Malware family:
rurat
Create hunting rule
Score:
  10/10
Tags:
family:rurat backdoor discovery trojan upx
Link:
https://tria.ge/reports/220807-3c4wwshgeq/
Behaviour
Modifies data under HKEY_USERS
Modifies registry class
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: SetClipboardViewer
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Program Files directory
Drops file in Windows directory
Drops file in System32 directory
Checks installed software on the system
Enumerates connected drives
Checks computer location settings
Loads dropped DLL
Blocklisted process makes network request
Executes dropped EXE
UPX packed file
RuRAT
Unpacked files
SH256 hash:
7f9edb120c0f11580ce7efbd8c7e4bd5f2e5a4059852c335266f831b3bc29b8d
MD5 hash:
f345ccc7b0b6be2cfe661be767926b9b
SHA1 hash:
e3fe2e4bd59394a632127057a9af78cc78742013
Link:
https://www.unpac.me/results/572d0213-e239-470d-ad73-e4f6cd71d1ca/
SH256 hash:
45e104696a11a2a22dad21ca1b9cf5456444f47130b059ca1952e7052264876d
MD5 hash:
773d1b7a96cc0fbba599e43eb8092592
SHA1 hash:
2c5aab7eea3ac86e543ec537d5b8149d4c9d15d7
Link:
https://www.unpac.me/results/572d0213-e239-470d-ad73-e4f6cd71d1ca/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/45e104696a11/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/45e104696a11a2a22dad21ca1b9cf5456444f47130b059ca1952e7052264876d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_RemoteUtilitiesRAT
Create hunting rule
Author:ditekSHen
Description:RemoteUtilitiesRAT RAT payload
Rule name:win_rms_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:with_urls
Create hunting rule
Author:Antonio Sanchez <asanchez@hispasec.com>
Description:Rule to detect the presence of an or several urls
Reference:http://laboratorio.blogs.hispasec.com/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments