MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0789e8d80d058cc3283d3041953b057ccf252b882630982b85786081a5cd5df0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 10


Intelligence 10 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0789e8d80d058cc3283d3041953b057ccf252b882630982b85786081a5cd5df0
SHA3-384 hash: 99fc23bb52259292031945d6352045227409b60390347eb64ab74aa120b1fbdd4c187620773de9a939c851800547ed29
SHA1 hash: 8168ecb6ba99c4b55042b67cdbcb72c7522002d2
MD5 hash: bd273870dc4b5c278336077f9cbe48e6
humanhash: wolfram-princess-vermont-tango
File name:Documents-09503-RFQ.exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:541'696 bytes
First seen:2021-07-15 09:01:10 UTC
Last seen:2021-07-15 09:59:49 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 013a60ab1248e2b43a2c84244ec5f60f (3 x RemcosRAT, 2 x AveMariaRAT, 1 x BitRAT)
ssdeep 12288:8cfO13yo3bFglRkdJTo7ZaNaknqOeAh8:8iOTbFc/P
Threatray 556 similar samples on MalwareBazaar
TLSH T19AB49D22F6D284B3D2B31C386C5B76A79D2B7E113DA8544F2BD8194C2B797C13929393
Reporter abuse_ch
Tags:exe RAT RemcosRAT

Intelligence

File Origin
# of uploads :
2
# of downloads :
156
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Documents-09503-RFQ.exe
Verdict:
Malicious activity
Analysis date:
2021-07-15 09:02:17 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/27783723-53b1-48f8-b763-9f20d5b1d2b3

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Remcos
Create hunting rule
Link:
https://www.capesandbox.com/analysis/171903/
Detection(s):
PUA.Win.Packer.Pequake-4
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/12d68d9b-3154-4240-abbc-71176cc63708
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/816771
Signature
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Creates a thread in another existing process (thread injection)
Delayed program exit found
Detected Remcos RAT
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Writes to foreign memory regions
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 449178 Sample: Documents-09503-RFQ.exe Startdate: 15/07/2021 Architecture: WINDOWS Score: 100 59 Found malware configuration 2->59 61 Malicious sample detected (through community Yara rule) 2->61 63 Detected Remcos RAT 2->63 65 3 other signatures 2->65 8 Documents-09503-RFQ.exe 1 24 2->8         started        13 Otprvwo.exe 16 2->13         started        15 Otprvwo.exe 16 2->15         started        process3 dnsIp4 45 ru5bsw.dm.files.1drv.com 8->45 53 2 other IPs or domains 8->53 41 C:\Users\Public\Libraries\...\Otprvwo.exe, PE32 8->41 dropped 75 Writes to foreign memory regions 8->75 77 Creates a thread in another existing process (thread injection) 8->77 79 Injects a PE file into a foreign processes 8->79 17 mobsync.exe 2 2 8->17         started        21 cmd.exe 1 8->21         started        23 cmd.exe 1 8->23         started        47 ru5bsw.dm.files.1drv.com 13->47 55 2 other IPs or domains 13->55 25 DpiScaling.exe 13->25         started        49 192.168.2.1 unknown unknown 15->49 51 ru5bsw.dm.files.1drv.com 15->51 57 2 other IPs or domains 15->57 27 logagent.exe 15->27         started        file5 signatures6 process7 dnsIp8 43 style.ptbagasps.co.id 194.29.101.219, 42024 HOSTHATCHUS unknown 17->43 67 Contains functionality to steal Chrome passwords or cookies 17->67 69 Contains functionality to inject code into remote processes 17->69 71 Contains functionality to steal Firefox passwords or cookies 17->71 73 Delayed program exit found 17->73 29 reg.exe 1 21->29         started        31 conhost.exe 21->31         started        33 cmd.exe 1 23->33         started        35 conhost.exe 23->35         started        signatures9 process10 process11 37 conhost.exe 29->37         started        39 conhost.exe 33->39         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0789e8d80d058cc3283d3041953b057ccf252b882630982b85786081a5cd5df0/
Threat name:
Win32.Trojan.Delf
Create hunting rule
Status:
Malicious
First seen:
2021-07-15 09:02:03 UTC
AV detection:
26 of 28 (92.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=a6e6rwanawgmgkb5gbazkoyfpthskk4ieyyjqk4fpbqidjonlxya._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
34ae6e94fd8ce101fadff4baf68d7c0b8bf606d1796b7c8199e7d45a9bc57a02
RemcosRAT
40dc655d06780c3f628f6ec2c3848d797c8ba88dcc50e3397e4e464ec12aaade
RemcosRAT
481d9a1417683843ff3bf8936227f69dbb80cad91b0c408bf30a99f889c09659
RemcosRAT
64d9ad7fa453939964d045971555233437f87c747989ff1d41f28b60258a4b97
RemcosRAT
747610321f9100e0dadd7c7728282b7403172ad1fc23e60eea12f4eaff28ce7e
RemcosRAT
8fabd89f985aae235b63098a58da4c32773e2aa81aae19f1e27467fd8924fc33
RemcosRAT
ba410d1931172915171c7769f798d6aaa1eab9f923c98f178f615ad75a6544f2
RemcosRAT
f0896ba259cc40a67474db857cbca2cd43099f5b49be45c3e3a3a34a06765b7f
RemcosRAT
f4dcc52b899bbe0d34ffbb44032c0186953c174beaf647c0556c7e71385c6bb4
RemcosRAT
f9e2ac4c422df790f71f3c1a4a9839edb7405862b1419144f08129400aaa1f6e
RemcosRAT
+ 546 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:modiloader family:remcos botnet:remotehost persistence rat trojan
Link:
https://tria.ge/reports/210715-s1cbpw18bx/
Behaviour
Modifies registry key
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Adds Run key to start application
ModiLoader, DBatLoader
Remcos
Malware Config
C2 Extraction:
style.ptbagasps.co.id:42024
Unpacked files
SH256 hash:
7977cf08b9e8faccde39a1620281265292b634c592dd532d8dad755d28b95d24
MD5 hash:
1c6dbe1008826c5a02e7504cab86ba14
SHA1 hash:
6a21b266b8e8fb84b11b6e798e052b729fdb1094
Link:
https://www.unpac.me/results/9ba9d430-f291-457b-ace3-53d22cda7706/
SH256 hash:
0789e8d80d058cc3283d3041953b057ccf252b882630982b85786081a5cd5df0
MD5 hash:
bd273870dc4b5c278336077f9cbe48e6
SHA1 hash:
8168ecb6ba99c4b55042b67cdbcb72c7522002d2
Link:
https://www.unpac.me/results/9ba9d430-f291-457b-ace3-53d22cda7706/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0789e8d80d058cc3283d3041953b057ccf252b882630982b85786081a5cd5df0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_UACBypass_EnvVarScheduledTasks
Create hunting rule
Author:ditekSHen
Description:detects Windows exceutables potentially bypassing UAC (ab)using Environment Variables in Scheduled Tasks

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/171903/

Comments