MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 075ec6ffbc5779e54c73a41b478b0bd6534f6cd5db435b8226d76c50012b267f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemoteManipulator


Vendor detections: 9


Intelligence 9 IOCs 1 YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 075ec6ffbc5779e54c73a41b478b0bd6534f6cd5db435b8226d76c50012b267f
SHA3-384 hash: 4d58e895cbac1c9a262932c0f5ba4a28bbd33da47d22afeb87a9342345dfc23df8ddf773e6d8c6034b10d0e623699bd4
SHA1 hash: 74dfe40fbae2b612acb8e6c1e7245bd1626506e7
MD5 hash: 1ad3fa87361d353764b45b5e23d76d43
humanhash: blossom-monkey-two-sad
File name:075EC6FFBC5779E54C73A41B478B0BD6534F6CD5DB435.exe
Download: download sample
Signature RemoteManipulator
Create hunting rule
File size:18'022'912 bytes
First seen:2021-05-28 19:45:17 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 19b321cb7a9ce31c90397152f38b67ea (29 x RemoteManipulator)
ssdeep 393216:mB+1YIlzyEzSOlMmUiQrXFL4/T8kiATdtwX6uWc115iGLCQ:mBelzp7lLQi/I/e8WcTgG
Threatray 28 similar samples on MalwareBazaar
TLSH C10733C3EBE04829EDBF0372A9F65F1C1E2AFC985B35230D19D4B21560A3D924C666D7
Reporter abuse_ch
Tags:exe RemoteManipulator


Avatar
abuse_ch
RemoteManipulator C2:
87.103.195.248:5655

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
87.103.195.248:5655 https://threatfox.abuse.ch/ioc/66351/

Intelligence

File Origin
# of uploads :
1
# of downloads :
182
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
075EC6FFBC5779E54C73A41B478B0BD6534F6CD5DB435.exe
Verdict:
Suspicious activity
Analysis date:
2021-05-28 21:50:30 UTC
Tags:
rat rms
Link:
https://app.any.run/tasks/a2b060c4-f5cb-4105-b0ed-441b89acbae6

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
PUA.Win.Packer.Upolyx-12
Create hunting rule

PUA.Win.Packer.Upx-4
Create hunting rule

PUA.Win.Packer.Exe-6
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Creating a file in the %temp% subdirectories
Creating a file
Launching a process
Modifying a system file
Creating a file in the Windows subdirectories
Creating a file in the Program Files subdirectories
Creating a process from a recently created file
Creating a service
Deleting a recently created file
Launching a service
Sending a custom TCP request
Enabling autorun for a service
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
RMSRemoteAdmin
Create hunting rule
Detection:
malicious
Classification:
evad
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/794048
Signature
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 426444 Sample: 075EC6FFBC5779E54C73A41B478... Startdate: 28/05/2021 Architecture: WINDOWS Score: 52 28 Multi AV Scanner detection for submitted file 2->28 30 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 2->30 7 rutserv.exe 10 8 2->7         started        10 075EC6FFBC5779E54C73A41B478B0BD6534F6CD5DB435.exe 5 2->10         started        12 rutserv.exe 2 2->12         started        14 4 other processes 2->14 process3 dnsIp4 24 87.103.195.248, 49734, 5655 ROSTELECOM-ASRU Russian Federation 7->24 26 192.168.2.1 unknown unknown 7->26 16 rfusclient.exe 7->16         started        18 rfusclient.exe 7->18         started        20 msiexec.exe 10->20         started        process5 process6 22 rfusclient.exe 16->22         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/075ec6ffbc5779e54c73a41b478b0bd6534f6cd5db435b8226d76c50012b267f/
Threat name:
Win32.Trojan.RemoteUtilities
Create hunting rule
Status:
Malicious
First seen:
2021-05-24 01:31:36 UTC
AV detection:
13 of 28 (46.43%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=a5pmn754k546ktdtuqnupcyl2zju63gv3nbvxarg25wfaajlez7q._file
Verdict:
malicious
Similar samples:
118dd258630c48b0beacd8b4c04c9c9cd3b9f698b660b6a904b1dfc033e00cd1
RemoteManipulator
1be887ab809f4d5f443d78ee02427954aaf63365be283fec335902ac48ba4445
RemoteManipulator
38602e2e2f729e174440339fd1551e133ae03d93e16bbcef8f0b9c8aa1da9b1c
RemoteManipulator
5312214b15330113f6eab71565e1e3c7d1ee3b59daa6703c271aaf3b192e6809
RemoteManipulator
6c8a5f43e07034d0545c60c137f96c6ab8da44cfd59a8654896c8f6c497aefad
RemoteManipulator
6dda990d8073fee71cedeabd622f6d7a9be6fb2e696bda71e7b709f1c08f5e36
RemoteManipulator
7cebce024d5351e0179898fffce2628756bdcd33f9ce3833f922f1265b6e5f73
RemoteManipulator
8fba783fb93013344dd2182721a3b1a3fbc96b7b8c49ad4b364c63a0f2b11496
RemoteManipulator
b5961f407c0afef04c9406ba17cbae3fe4cc575b47e50081abbda0d96f9c0f18
RemoteManipulator
ee0400adcec67d05e4b6825df53ff7e5fb5d86680a65264976940239c322d9fb
RemoteManipulator
+ 18 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
discovery upx
Link:
https://tria.ge/reports/210528-zcev8cbb82/
Behaviour
Modifies data under HKEY_USERS
Modifies registry class
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: SetClipboardViewer
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Program Files directory
Drops file in Windows directory
Drops file in System32 directory
Checks installed software on the system
Enumerates connected drives
Checks computer location settings
Loads dropped DLL
Blocklisted process makes network request
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/075ec6ffbc5779e54c73a41b478b0bd6534f6cd5db435b8226d76c50012b267f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Ping_Del_method_bin_mem
Create hunting rule
Author:James_inthe_box
Description:cmd ping IP nul del
Rule name:suspicious_packer_section
Create hunting rule
Author:@j0sm1
Description:The packer/protector section names/keywords
Reference:http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments