MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 06f04dab2e4bc0b0b1b876206bc111e71002eae688e45f3ee772a8f71ae39a96. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 17


Intelligence 17 IOCs YARA 26 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 06f04dab2e4bc0b0b1b876206bc111e71002eae688e45f3ee772a8f71ae39a96
SHA3-384 hash: 49c3c7488daceff60fb35a209a15a0185d04168b2f2bc8587e83760feae4eaf172dc06a06cb3f6516ed428dd5bea998c
SHA1 hash: ed0c48c0da310b9b31033ecac5a81e391db2b3b4
MD5 hash: 22952860c728a1ebc024b7f2893a17fd
humanhash: angel-alaska-beer-enemy
File name:Banque Misr_نسخة الدفع.Pdf.bat
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'115'648 bytes
First seen:2023-08-17 17:43:36 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 24576:hFeuWCXd1UNe9aepFenMQGsvZT+mQdYWEqUkpn5WN4iWkxr:N1UNewnMQGKU19UWwxP1
Threatray 2'468 similar samples on MalwareBazaar
TLSH T1DD35367CFD227663CA9F0D734DD3D47686340E12775B98F404DBB2D6BAB826895002BA
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter abuse_ch
Tags:bat exe RAT RemcosRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
352
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
remcos
Create hunting rule
ID:
1
File name:
Banque Misr_نسخة الدفع.Pdf.bat
Verdict:
Malicious activity
Analysis date:
2023-08-17 17:45:47 UTC
Tags:
rat remcos remote stealer
Link:
https://app.any.run/tasks/986823c3-d6bf-4df4-8c5e-4b33df12146b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Remcos
Create hunting rule
Link:
https://www.capesandbox.com/analysis/443244/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.2281.8884.17148.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Launching a process
Creating a file
Сreating synchronization primitives
DNS request
Sending an HTTP GET request
Sending a TCP request to an infection source
Unauthorized injection to a system process
Enabling autorun by creating a file
Gathering data
Verdict:
Malicious
Labled as:
Lazy.Generic
Link:
https://www.hybrid-analysis.com/sample/06f04dab2e4bc0b0b1b876206bc111e71002eae688e45f3ee772a8f71ae39a96
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
REMCOS
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/cc1e51b1-dd09-4283-9436-357e6cf1c0f6
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
spre.phis.troj.adwa.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1292945
Signature
.NET source code contains potential unpacker
Allocates memory in foreign processes
Bypasses PowerShell execution policy
C2 URLs / IPs found in malware configuration
Contains functionality to bypass UAC (CMSTPLUA)
Contains functionality to inject code into remote processes
Contains functionality to modify clipboard data
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Delayed program exit found
Drops PE files to the startup folder
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Powershell drops PE file
Sigma detected: Copy file to startup via Powershell
Sigma detected: Remcos
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file / registry access)
Uses an obfuscated file name to hide its real file extension (double extension)
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected Remcos RAT
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1292945 Sample: Banque_Misr_#U0646#U0633#U0... Startdate: 17/08/2023 Architecture: WINDOWS Score: 100 48 Multi AV Scanner detection for domain / URL 2->48 50 Found malware configuration 2->50 52 Malicious sample detected (through community Yara rule) 2->52 54 11 other signatures 2->54 8 Banque_Misr_#U0646#U0633#U062e#U0629_#U0627#U0644#U062f#U0641#U0639.Pdf.bat.exe 3 2->8         started        11 chrome.exe.exe 3 2->11         started        process3 signatures4 56 Bypasses PowerShell execution policy 8->56 58 Writes to foreign memory regions 8->58 60 Allocates memory in foreign processes 8->60 13 RegAsm.exe 3 13 8->13         started        17 RegAsm.exe 8->17         started        19 powershell.exe 13 8->19         started        62 Injects a PE file into a foreign processes 11->62 22 powershell.exe 11->22         started        process5 dnsIp6 44 172.96.14.57, 49718, 49719, 8925 UNREAL-SERVERSUS Canada 13->44 46 geoplugin.net 178.237.33.50, 49720, 80 ATOM86-ASATOM86NL Netherlands 13->46 70 Maps a DLL or memory area into another process 13->70 24 RegAsm.exe 1 13->24         started        27 RegAsm.exe 13->27         started        29 RegAsm.exe 13->29         started        35 27 other processes 13->35 72 Contains functionality to bypass UAC (CMSTPLUA) 17->72 74 Contains functionality to steal Chrome passwords or cookies 17->74 76 Contains functionality to inject code into remote processes 17->76 82 3 other signatures 17->82 40 C:\Users\user\AppData\...\chrome.exe.exe, PE32 19->40 dropped 78 Drops PE files to the startup folder 19->78 80 Powershell drops PE file 19->80 31 conhost.exe 19->31         started        33 conhost.exe 22->33         started        file7 signatures8 process9 dnsIp10 64 Tries to steal Instant Messenger accounts or passwords 24->64 66 Tries to steal Mail credentials (via file / registry access) 24->66 42 192.168.2.1 unknown unknown 35->42 68 Tries to harvest and steal browser information (history, passwords, etc) 35->68 38 conhost.exe 35->38         started        signatures11 process12
Detection:
remcos
Create hunting rule
Link:
https://mwdb.cert.pl/sample/06f04dab2e4bc0b0b1b876206bc111e71002eae688e45f3ee772a8f71ae39a96/
Threat name:
Win32.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2023-08-17 08:25:56 UTC
File Type:
PE (.Net Exe)
Extracted files:
7
AV detection:
20 of 38 (52.63%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=a3ye3kzojpalbmnyoyqgxqir44iaf2xgrdsf6pxhokupogxdtkla._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
0e25b5299c3df59e05d296b1478d43094d5d81e1a5b8706fd355b36388244326
RemcosRAT
1c9708a7c1cca2ffb1fb6711828553521a81c313bd3dcefba441e546d2457e5d
RemcosRAT
2470f5cd9fcdd5fee479668698bb2b5d09e8319caf8ead338a8c776dba14064b
RemcosRAT
251b8eecc957d32f67f2433f24b995ae2b0c5753348a1ceaded0accb3d25b052
RemcosRAT
37fe1989c187c6493c161901f4a0b5fa6659f311dcac5dc966efe91e6f42ffef
RemcosRAT
4eaf10beee3ffe3dff4d6bd78c7a8f04c7a1b067c1f7cb6d414a53d56b1dee8e
RemcosRAT
50f3db3dc8ef4ee255514877f5715d26d1838699cf80d057cd046c4ef1ffb6b2
RemcosRAT
dcb2c88a0e980e5d5b2227eb3ede87e3aed37ac3a1126bbc547671763a1c102e
RemcosRAT
f7ecefbcf3572d8b3f40ab5c23b1a62366bb8d49b603b3d54e4b46bcd6779eee
RemcosRAT
+ 2'458 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:remotehost rat spyware stealer
Link:
https://tria.ge/reports/230817-wa5l3sda8w/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Drops startup file
Reads user/profile data of web browsers
NirSoft MailPassView
NirSoft WebBrowserPassView
Nirsoft
Remcos
Malware Config
C2 Extraction:
172.96.14.57:8925
Unpacked files
SH256 hash:
3f563103cd47e76926d7d100cb0dafb428e7a6997fd80ef32a88a8e6587bcb2c
MD5 hash:
324015603e621bd36f85949ff2ed9c44
SHA1 hash:
f24f57b2f15473866246989e5bba38c36fb20c50
Link:
https://www.unpac.me/results/2c31c806-37ce-44f8-9a46-8ad00bc07451/
SH256 hash:
4150c9d7721194c5d0e5502273a49809cff056d702721120ad1c6db0e493e4c6
MD5 hash:
b097d66b7d4baf7c42357b0f4cf8c558
SHA1 hash:
667c6b615b436ce1340974cc15c6ca99f0d62f88
Detections:
Remcos
Create hunting rule
win_remcos_auto
Create hunting rule
Link:
https://www.unpac.me/results/2c31c806-37ce-44f8-9a46-8ad00bc07451/
Parent samples :
2470f5cd9fcdd5fee479668698bb2b5d09e8319caf8ead338a8c776dba14064b
06f04dab2e4bc0b0b1b876206bc111e71002eae688e45f3ee772a8f71ae39a96
SH256 hash:
198a65f6a3f780f1a022f030629e8561c31cc555a113f570a566d40d1ee56a05
MD5 hash:
9b3a1b5d3ffe9fb9db6c5aaefa1ae076
SHA1 hash:
0da05e4c72430da0d061a02cd6cf50c41e6bd83a
Link:
https://www.unpac.me/results/2c31c806-37ce-44f8-9a46-8ad00bc07451/
SH256 hash:
06f04dab2e4bc0b0b1b876206bc111e71002eae688e45f3ee772a8f71ae39a96
MD5 hash:
22952860c728a1ebc024b7f2893a17fd
SHA1 hash:
ed0c48c0da310b9b31033ecac5a81e391db2b3b4
Link:
https://www.unpac.me/results/2c31c806-37ce-44f8-9a46-8ad00bc07451/
Malware family:
Remcos
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/06f04dab2e4b/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/06f04dab2e4bc0b0b1b876206bc111e71002eae688e45f3ee772a8f71ae39a96

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:BLOWFISH_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for Blowfish constants
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:iexplorer_remcos
Create hunting rule
Author:iam-py-test
Description:Detect iexplorer being taken over by Remcos
Rule name:INDICATOR_EXE_Packed_MPress
Create hunting rule
Author:ditekSHen
Description:Detects executables built or packed with MPress PE compressor
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
Create hunting rule
Author:ditekSHen
Description:Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:maldoc_getEIP_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:QbotStuff
Create hunting rule
Author:anonymous
Rule name:Remcos
Create hunting rule
Author:kevoreilly
Description:Remcos Payload
Rule name:REMCOS_RAT_variants
Create hunting rule
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:TeslaCryptPackedMalware
Create hunting rule
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Windows_Trojan_Remcos_b296e965
Create hunting rule
Author:Elastic Security
Rule name:win_remcos_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.remcos.
Rule name:yara_template
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

Executable exe 06f04dab2e4bc0b0b1b876206bc111e71002eae688e45f3ee772a8f71ae39a96

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/443244/

Comments