MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 040752d18f978a437684d118f6ca5322c51b956f8911b32307db1fd4559a916c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemoteManipulator


Vendor detections: 7


Intelligence 7 IOCs 1 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 040752d18f978a437684d118f6ca5322c51b956f8911b32307db1fd4559a916c
SHA3-384 hash: 75d319e0a928f586d654bf11d5dbe68a90533b7a3864f4bec832b7872a9dc93e204b8a8ef63f504917476005225d5f62
SHA1 hash: 70a1640096b9c8842fa58777fa0c9d407db602f8
MD5 hash: 3c545c5efb38a7291c3ba25d189df717
humanhash: fruit-lamp-connecticut-charlie
File name:3c545c5efb38a7291c3ba25d189df717.exe
Download: download sample
Signature RemoteManipulator
Create hunting rule
File size:20'606'976 bytes
First seen:2021-07-24 17:05:19 UTC
Last seen:2021-07-24 17:48:53 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash a2adaf9422c8d5596ce912860ce76592 (5 x RemoteManipulator)
ssdeep 393216:DLpt5mK/0AI3mIiQFWs2/HUie2SwnJu7AihlWuZ2HYHYCQQaK0P:rTI3t72/HvdS6QAWlhYrQaF
Threatray 37 similar samples on MalwareBazaar
TLSH T1A2271293F3C8653EE4AF0B32557386589D37BF612A528F0F27F5680C8E365412A3A647
dhash icon c0dacabacac0c244 (20 x RemoteManipulator)
Reporter abuse_ch
Tags:exe RemoteManipulator


Avatar
abuse_ch
RemoteManipulator C2:
65.0.5.240:5655

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
65.0.5.240:5655 https://threatfox.abuse.ch/ioc/162579/

Intelligence

File Origin
# of uploads :
2
# of downloads :
148
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
3c545c5efb38a7291c3ba25d189df717.exe
Verdict:
No threats detected
Analysis date:
2021-07-24 17:06:52 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/a89180b5-c9b0-414d-8338-e2ee32b186b9

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
PUA.Win.Packer.Exe-6
Create hunting rule

PUA.Win.Tool.RemoteUtilities-9869515-0
Create hunting rule

Result
Verdict:
UNKNOWN
Result
Threat name:
RMSRemoteAdmin Remote Utilities
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/821274
Signature
Detected Remote Utilities RAT
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 453685 Sample: LZU0K7P11Z.exe Startdate: 24/07/2021 Architecture: WINDOWS Score: 60 33 Multi AV Scanner detection for submitted file 2->33 35 Detected Remote Utilities RAT 2->35 37 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 2->37 7 rutserv.exe 7 4 2->7         started        11 LZU0K7P11Z.exe 5 2->11         started        14 rutserv.exe 2 2->14         started        16 8 other processes 2->16 process3 dnsIp4 29 65.0.5.240, 49752, 49755, 5655 AMAZON-02US United States 7->29 41 Detected Remote Utilities RAT 7->41 18 rfusclient.exe 7->18         started        21 rfusclient.exe 7->21         started        27 C:\Users\user\...\host6.12.b1_unsigned.msi, Intel;1033 11->27 dropped 23 msiexec.exe 11->23         started        31 192.168.2.1 unknown unknown 14->31 file5 signatures6 process7 signatures8 39 Detected Remote Utilities RAT 18->39 25 rfusclient.exe 18->25         started        process9
Gathering data
Threat name:
Win32.Trojan.RemoteUtilities
Create hunting rule
Status:
Malicious
First seen:
2021-07-24 05:31:35 UTC
AV detection:
10 of 27 (37.04%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=aqdvfumps6feg5ue2empnsstelcrxflprei3giyh3mp5ivm2sfwa._file
Verdict:
malicious
Similar samples:
049f386b48f72d13008397a7421a63ee16b65ad432263c9ee59b1a13521d9609
RemoteManipulator
4de20c5375b9f484f3c764bc62721329813692e6441060fa1674ecec0f13584b
RemoteManipulator
6984fbcdc07aa5d975b4f6742888e3185d6091440b0b76bce13ca81d2a7f931e
RemoteManipulator
6c8a5f43e07034d0545c60c137f96c6ab8da44cfd59a8654896c8f6c497aefad
RemoteManipulator
7cebce024d5351e0179898fffce2628756bdcd33f9ce3833f922f1265b6e5f73
RemoteManipulator
8fba783fb93013344dd2182721a3b1a3fbc96b7b8c49ad4b364c63a0f2b11496
RemoteManipulator
c8ebec4136a41a11aa96976ce1b5d4b01785ff3ac94b781550cc2e11984c7a2c
RemoteManipulator
cbe3b86357b4f4d072ae00d8373f2e553e5cc43008e1be2ade4fe463f956df35
RemoteManipulator
e5f575d9223be5a7a825f598e21b5ec4475ea6a9d58ad0e87932a57768908027
RemoteManipulator
+ 27 additional samples on MalwareBazaar
Result
Malware family:
rurat
Create hunting rule
Score:
  10/10
Tags:
family:rurat backdoor discovery trojan
Link:
https://tria.ge/reports/210724-tnpd2xxtrx/
Behaviour
Modifies data under HKEY_USERS
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: SetClipboardViewer
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Program Files directory
Drops file in Windows directory
Checks installed software on the system
Enumerates connected drives
Checks computer location settings
Loads dropped DLL
Blocklisted process makes network request
Executes dropped EXE
RuRAT
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/040752d18f978a437684d118f6ca5322c51b956f8911b32307db1fd4559a916c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments