MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 02dda0916789c0c3572cbbf0e119cbae7be42e10eca39be66bbaaf2468a62b7a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemoteManipulator


Vendor detections: 8


Intelligence 8 IOCs 1 YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 02dda0916789c0c3572cbbf0e119cbae7be42e10eca39be66bbaaf2468a62b7a
SHA3-384 hash: 38254cfb3060c1b25eec453809fc0c89aa944cee3b36dccbb8dff27c4bb4abf909dad0fcf86a41d5a49c212c194e8fe5
SHA1 hash: 3bc26a4c8e5f8a93671c9e24678530b51224ef61
MD5 hash: 5598febfbf00839c9f7047d9fe3205e3
humanhash: alaska-pasta-moon-sierra
File name:5598febfbf00839c9f7047d9fe3205e3.exe
Download: download sample
Signature RemoteManipulator
Create hunting rule
File size:16'961'008 bytes
First seen:2022-02-08 01:51:41 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 38be718d163809a15e0c7a672311fe41 (18 x RemoteManipulator)
ssdeep 393216:fBPaYwNAo0ZbxKOkJ6G219AU/DafoxrB:fBSWvxaJ6jbLG4
Threatray 56 similar samples on MalwareBazaar
TLSH T1E3073352FBE50818E4BB5B7B8DFD4B140B6BBC99891243C81358B0299C773826DE57CB
File icon (PE):PE icon
dhash icon c4dacabacac0c244 (47 x RemoteManipulator)
Reporter abuse_ch
Tags:exe RemoteManipulator signed Ter-Osipov Aleksei Vladimirovich

Code Signing Certificate

Organisation:Ter-Osipov Aleksei Vladimirovich
Issuer:DigiCert SHA2 Assured ID Code Signing CA
Algorithm:sha256WithRSAEncryption
Valid from:2021-05-25T00:00:00Z
Valid to:2023-07-18T23:59:59Z
Serial number: 0e62fe155fb23337f1cffbc7bf03b6d1
Intelligence: 6 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: 400b879e19ee2e650226a3275e2fae3e9629c6508400a7916e381bc936b275dd
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform


Avatar
abuse_ch
RemoteManipulator C2:
85.143.112.188:5655

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
85.143.112.188:5655 https://threatfox.abuse.ch/ioc/382106/

Intelligence

File Origin
# of uploads :
1
# of downloads :
184
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
RemoteManipulator.zip
Verdict:
No threats detected
Analysis date:
2022-02-08 06:46:02 UTC
Tags:
rat rms
Link:
https://app.any.run/tasks/9678dc9b-c027-4e7b-be36-02a72e2a5452

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
PUA.Win.Packer.Upolyx-12
Create hunting rule

PUA.Win.Packer.Upx-4
Create hunting rule

PUA.Win.Packer.Exe-6
Create hunting rule

Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Sending a custom TCP request
Sending an HTTP GET request
Creating a file in the Windows subdirectories
Searching for the window
Сreating synchronization primitives
Creating a window
Searching for synchronization primitives
Creating a file in the %AppData% subdirectories
Creating a process from a recently created file
Launching a service
DNS request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
control.exe greyware overlay packed remote.exe replace.exe
Link:
https://www.filescan.io/uploads/6201cccf845a69d7734be5dd/reports/061ec44f-d910-48f5-9b16-75c09263c9b0/overview
Result
Verdict:
UNKNOWN
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/3156b23d-1e84-45ee-abab-5240739e4f36
Result
Threat name:
RMSRemoteAdmin
Create hunting rule
Detection:
suspicious
Classification:
spyw.evad
Score:
34 / 100
Link:
https://www.joesandbox.com/analysis/935681
Signature
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Query firmware table information (likely to detect VMs)
Tries to steal Mail credentials (via file registry)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 568160 Sample: fvOgNkoWaY.exe Startdate: 08/02/2022 Architecture: WINDOWS Score: 34 40 Malicious sample detected (through community Yara rule) 2->40 42 Multi AV Scanner detection for submitted file 2->42 44 Tries to steal Mail credentials (via file registry) 2->44 46 Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors) 2->46 9 fvOgNkoWaY.exe 18 2->9         started        process3 file4 26 C:\Users\user\AppData\Roaming\...\rutserv.exe, PE32 9->26 dropped 28 C:\Users\user\AppData\...\rfusclient.exe, PE32 9->28 dropped 30 C:\Users\user\...\webmvorbisencoder.dll, PE32 9->30 dropped 32 7 other files (none is malicious) 9->32 dropped 12 rfusclient.exe 3 9->12         started        process5 signatures6 52 Query firmware table information (likely to detect VMs) 12->52 15 rutserv.exe 2 12->15         started        process7 signatures8 54 Query firmware table information (likely to detect VMs) 15->54 18 rutserv.exe 8 16 15->18         started        process9 dnsIp10 34 mail-server.mephi.ru 85.143.112.141, 49809, 587 AS5567RU Russian Federation 18->34 36 85.143.112.188, 49816, 49833, 5655 AS5567RU Russian Federation 18->36 48 Query firmware table information (likely to detect VMs) 18->48 22 rfusclient.exe 2 18->22         started        signatures11 process12 dnsIp13 38 192.168.2.1 unknown unknown 22->38 50 Query firmware table information (likely to detect VMs) 22->50 signatures14
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/02dda0916789c0c3572cbbf0e119cbae7be42e10eca39be66bbaaf2468a62b7a/
Threat name:
Win32.Trojan.RemoteUtilities
Create hunting rule
Status:
Malicious
First seen:
2021-12-07 00:51:05 UTC
File Type:
PE (Exe)
Extracted files:
89
AV detection:
9 of 43 (20.93%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=alo2belhrhamgvzmxpyocgolvz56ilqq5srzxztlxkxsi2fgfn5a._file
Verdict:
malicious
Similar samples:
1fb6087e4c6654baf677b60bf6f12b8a19e232e5e74713e6beb37678c674bf1c
RemoteManipulator
22ecf75f81c4e67a889f0f89adee960deb071e289b84c4cb6002d744b08f2492
RemoteManipulator
56cec810fc6f445e17a04306b653bb3296b55fe481b518c9aca4b1ef69824a3e
RemoteManipulator
8b4e974a65677792d97fdcb35bba28c1e961b6b32c99b4baa81bfdd7c85348bd
RemoteManipulator
bbc131fda4a9d5d10d774f609a121390bb56456f358420db95d35ef9760acad9
RemoteManipulator
d74f00989c51e8c7ea20038e712df510ee4f0eab405666634036ba255462a59f
RemoteManipulator
ee3eeb0939e2e1b3ee54b369f044f5f666a64cf74d55c278dcfdf4c278a53214
RemoteManipulator
+ 46 additional samples on MalwareBazaar
Result
Malware family:
rms
Create hunting rule
Score:
  10/10
Tags:
family:rms rat trojan upx
Link:
https://tria.ge/reports/220208-cae7msbhcl/
Behaviour
Modifies data under HKEY_USERS
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Windows directory
Drops file in System32 directory
Checks computer location settings
Loads dropped DLL
Executes dropped EXE
RMS
Suspicious use of NtCreateUserProcessOtherParentProcess
Unpacked files
SH256 hash:
4e509d450fde2008bc6c90986594d8374ac7a9dec637262fd1cb6fbd61f13fac
MD5 hash:
6d13f5d287fd735a9bbc261aafb49006
SHA1 hash:
2dbd298f0b5ea463dba1d5cd226cd125280a4738
Link:
https://www.unpac.me/results/039e723b-1bf8-4b63-b3aa-176a2341e0d3/
SH256 hash:
02dda0916789c0c3572cbbf0e119cbae7be42e10eca39be66bbaaf2468a62b7a
MD5 hash:
5598febfbf00839c9f7047d9fe3205e3
SHA1 hash:
3bc26a4c8e5f8a93671c9e24678530b51224ef61
Link:
https://www.unpac.me/results/039e723b-1bf8-4b63-b3aa-176a2341e0d3/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Adsterra_Adware_DOM
Create hunting rule
Author:IlluminatiFish
Description:Detects Adsterra adware script being loaded without the user's consent
Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:MALWARE_Win_RemoteUtilitiesRAT
Create hunting rule
Author:ditekSHen
Description:RemoteUtilitiesRAT RAT payload
Rule name:win_rms_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:with_urls
Create hunting rule
Author:Antonio Sanchez <asanchez@hispasec.com>
Description:Rule to detect the presence of an or several urls
Reference:http://laboratorio.blogs.hispasec.com/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments