MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0451434391ff07fc5849fb0720ab7f9959314aab5bcffe37490c1a893ba15d6c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 14


Intelligence 14 IOCs YARA 28 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0451434391ff07fc5849fb0720ab7f9959314aab5bcffe37490c1a893ba15d6c
SHA3-384 hash: 4c6c430f168f49b259460cbe681456c20fc3a9babda40d8cce82a390f276ecaac5a34dbe510506bb7955cb91d2e0a422
SHA1 hash: ada4fe8d1eed92c88dc22a51fdf0e87461a915da
MD5 hash: ec7c3a311dec09d9feccc61e97bef389
humanhash: saturn-magnesium-steak-louisiana
File name:SecuriteInfo.com.Win32.DropperX-gen.22181.19262
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'133'056 bytes
First seen:2023-09-18 04:40:37 UTC
Last seen:2023-09-18 13:51:15 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash c2ad891bcde9025eb987ac7b7c972a6f (2 x DBatLoader, 2 x RemcosRAT, 1 x Formbook)
ssdeep 24576:MbrDmg606ige8Nl24myHD6GfZX8H5tav:0tqw
Threatray 2'624 similar samples on MalwareBazaar
TLSH T18C357D24B343A870E016B975C807E694E0EA7DD07E1D54CA51AC7A761EFD3E33A1C98B
TrID 50.1% (.EXE) InstallShield setup (43053/19/16)
15.2% (.SCR) Windows screen saver (13097/50/3)
12.2% (.EXE) Win64 Executable (generic) (10523/12/4)
7.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
5.2% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 30828c8c8c864840 (2 x DBatLoader, 2 x RemcosRAT, 1 x Formbook)
Reporter SecuriteInfoCom
Tags:exe RemcosRAT

Intelligence

File Origin
# of uploads :
3
# of downloads :
290
Origin country :
FR FR
Vendor Threat Intelligence
Detection:
ModiLoader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/449238/
Detection(s):
SecuriteInfo.com.Win32.DropperX-gen.22181.19262.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a window
Sending a custom TCP request
DNS request
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Searching for the window
Gathering data
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
control keylogger lolbin remcos
Link:
https://www.filescan.io/uploads/6507d4e033582f234efa5d6f/reports/8cbd1a17-e5c4-4f29-8c09-7f3c9dc01e87/overview
Verdict:
Malicious
Labled as:
Malware
Link:
https://www.hybrid-analysis.com/sample/0451434391ff07fc5849fb0720ab7f9959314aab5bcffe37490c1a893ba15d6c
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/3b8b3c62-440f-4c10-bb8d-7d7209e4a164
Result
Threat name:
Remcos, DBatLoader
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1309760
Signature
Adds a directory exclusion to Windows Defender
Allocates many large memory junks
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to bypass UAC (CMSTPLUA)
Contains functionality to inject code into remote processes
Contains functionality to modify clipboard data
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Delayed program exit found
DLL side loading technique detected
Drops executables to the windows directory (C:\Windows) and starts them
Drops PE files with a suspicious file extension
Found malware configuration
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Remcos
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file / registry access)
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Writes to foreign memory regions
Yara detected DBatLoader
Yara detected Remcos RAT
Yara detected UAC Bypass using CMSTP
Yara detected WebBrowserPassView password recovery tool
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1309760 Sample: SecuriteInfo.com.Win32.Drop... Startdate: 18/09/2023 Architecture: WINDOWS Score: 100 88 Found malware configuration 2->88 90 Malicious sample detected (through community Yara rule) 2->90 92 Antivirus detection for URL or domain 2->92 94 9 other signatures 2->94 11 SecuriteInfo.com.Win32.DropperX-gen.22181.19262.exe 1 7 2->11         started        16 Qyyweaym.PIF 2->16         started        process3 dnsIp4 74 web.fe.1drv.com 11->74 76 onedrive.live.com 11->76 82 2 other IPs or domains 11->82 62 C:\Users\Public\Libraries\netutils.dll, PE32+ 11->62 dropped 64 C:\Users\Public\Libraries\easinvoker.exe, PE32+ 11->64 dropped 66 C:\Users\Public\Libraries\Qyyweaym.PIF, PE32 11->66 dropped 118 Drops PE files with a suspicious file extension 11->118 120 Writes to foreign memory regions 11->120 122 Allocates memory in foreign processes 11->122 124 Injects a PE file into a foreign processes 11->124 18 SndVol.exe 3 14 11->18         started        22 cmd.exe 1 11->22         started        78 web.fe.1drv.com 16->78 80 onedrive.live.com 16->80 84 2 other IPs or domains 16->84 126 Antivirus detection for dropped file 16->126 128 Multi AV Scanner detection for dropped file 16->128 130 Allocates many large memory junks 16->130 24 SndVol.exe 16->24         started        file5 signatures6 process7 dnsIp8 68 163.123.143.32, 42199, 49714, 49715 ILIGHT-NETUS Reserved 18->68 70 geoplugin.net 178.237.33.50, 49716, 80 ATOM86-ASATOM86NL Netherlands 18->70 96 Contains functionality to bypass UAC (CMSTPLUA) 18->96 98 Contains functionality to steal Chrome passwords or cookies 18->98 100 Contains functionality to inject code into remote processes 18->100 108 4 other signatures 18->108 26 SndVol.exe 18->26         started        29 SndVol.exe 18->29         started        31 SndVol.exe 18->31         started        41 3 other processes 18->41 102 Uses ping.exe to sleep 22->102 104 Drops executables to the windows directory (C:\Windows) and starts them 22->104 106 Uses ping.exe to check the status of other devices and networks 22->106 33 easinvoker.exe 22->33         started        35 PING.EXE 1 22->35         started        38 xcopy.exe 2 22->38         started        43 8 other processes 22->43 signatures9 process10 dnsIp11 112 Tries to steal Instant Messenger accounts or passwords 26->112 114 Tries to steal Mail credentials (via file / registry access) 26->114 116 Tries to harvest and steal browser information (history, passwords, etc) 29->116 45 cmd.exe 1 33->45         started        72 127.0.0.1 unknown unknown 35->72 58 C:\Windows \System32\easinvoker.exe, PE32+ 38->58 dropped 60 C:\Windows \System32\netutils.dll, PE32+ 43->60 dropped file12 signatures13 process14 signatures15 132 Adds a directory exclusion to Windows Defender 45->132 48 cmd.exe 1 45->48         started        51 conhost.exe 45->51         started        process16 signatures17 86 Adds a directory exclusion to Windows Defender 48->86 53 powershell.exe 23 48->53         started        process18 signatures19 110 DLL side loading technique detected 53->110 56 conhost.exe 53->56         started        process20
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0451434391ff07fc5849fb0720ab7f9959314aab5bcffe37490c1a893ba15d6c/
Threat name:
Win32.Trojan.Remcos
Create hunting rule
Status:
Malicious
First seen:
2023-09-18 00:27:37 UTC
File Type:
PE (Exe)
Extracted files:
72
AV detection:
20 of 36 (55.56%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ariugq4r74d7ywcj7mdsbk37tfmtcsvllph74n2jbqniso5blvwa._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
30423662efb2bc06468689cd76e932013950d6fd8646f072ebedea0df0a1fd4d
RemcosRAT
327946233fb8a8dba8e47aa58499a1d06b50fc635d9ec674156617a039d7e85a
RemcosRAT
6483ccee0337b0393c9799ca324992b61655cf331cb31c79edcf3f1160e95148
RemcosRAT
6d69abf704c0ac0c71d7d35cc0eaa5b0ba230b7538ee159ad415b06798143c33
RemcosRAT
70844fa5991d0089d8e76bb510ba8aeaeb1f0f053741c5876b15c4ced5075dc9
RemcosRAT
9bf55d8f3b892e6b8706ec526eaa51cc8a1a727b45759494e2e388979a5708b8
RemcosRAT
b2d5e15268cb130c995118e17afa1198ca19604a20b91f1907a7ef18210db30f
RemcosRAT
d4da52e07bcf01df28c9106df95b75385eef2c06e3c4754efa6d1b772e940ea7
RemcosRAT
e029bc85866faf62332458961316cf1561c335b06076936f9e1ae87cbc0a868e
RemcosRAT
ea9723cd4dfeb319cedc75c0dd4cb5fa326b995580aee939085780092aafcda9
RemcosRAT
+ 2'614 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:modiloader family:remcos botnet:remotehost collection persistence rat trojan
Link:
https://tria.ge/reports/230918-fa4f1sfa7t/
Behaviour
Enumerates system info in registry
Runs ping.exe
Script User-Agent
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Accesses Microsoft Outlook accounts
Adds Run key to start application
Executes dropped EXE
Loads dropped DLL
ModiLoader Second Stage
NirSoft MailPassView
NirSoft WebBrowserPassView
Nirsoft
ModiLoader, DBatLoader
Remcos
Malware Config
C2 Extraction:
127.0.0.1:43991
127.0.0.1:42199
163.123.143.32:42199
163.123.143.32:43991
Unpacked files
SH256 hash:
a3eb81973377df073f258bad530cdaa4e73b5c7093b5edefd48aec9774a089c7
MD5 hash:
93dbd1cda2746449839b50d59f1fd6c5
SHA1 hash:
a49d126775164e76283a998431f097f8457b26f0
Detections:
win_dbatloader_g1
Create hunting rule
Link:
https://www.unpac.me/results/b45ac940-b4d7-471f-8a3f-4b71eb50395a/
SH256 hash:
7bcdc2e607abc65ef93afd009c3048970d9e8d1c2a18fc571562396b13ebb301
MD5 hash:
c116d3604ceafe7057d77ff27552c215
SHA1 hash:
452b14432fb5758b46f2897aeccd89f7c82a727d
Link:
https://www.unpac.me/results/b45ac940-b4d7-471f-8a3f-4b71eb50395a/
SH256 hash:
0451434391ff07fc5849fb0720ab7f9959314aab5bcffe37490c1a893ba15d6c
MD5 hash:
ec7c3a311dec09d9feccc61e97bef389
SHA1 hash:
ada4fe8d1eed92c88dc22a51fdf0e87461a915da
Link:
https://www.unpac.me/results/b45ac940-b4d7-471f-8a3f-4b71eb50395a/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/0451434391ff/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0451434391ff07fc5849fb0720ab7f9959314aab5bcffe37490c1a893ba15d6c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BLOWFISH_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for Blowfish constants
Rule name:BobSoftMiniDelphiBoBBobSoft
Create hunting rule
Author:malware-lu
Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:iexplorer_remcos
Create hunting rule
Author:iam-py-test
Description:Detect iexplorer being taken over by Remcos
Rule name:INDICATOR_EXE_Packed_MPress
Create hunting rule
Author:ditekSHen
Description:Detects executables built or packed with MPress PE compressor
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
Create hunting rule
Author:ditekSHen
Description:Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:maldoc_getEIP_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:QbotStuff
Create hunting rule
Author:anonymous
Rule name:Remcos
Create hunting rule
Author:kevoreilly
Description:Remcos Payload
Rule name:REMCOS_RAT_variants
Create hunting rule
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:TeslaCryptPackedMalware
Create hunting rule
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Windows_Trojan_Remcos_b296e965
Create hunting rule
Author:Elastic Security
Rule name:win_remcos_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.remcos.
Rule name:win_remcos_rat_unpacked
Create hunting rule
Author:Matthew @ Embee_Research
Description:Detects strings present in remcos rat Samples.
Rule name:yara_template
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/449238/

Comments