MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0bb25dccd5ee69b35f2c03c04b50ec23573929d193739becb1c623d32db64e4a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 13


Intelligence 13 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0bb25dccd5ee69b35f2c03c04b50ec23573929d193739becb1c623d32db64e4a
SHA3-384 hash: 23252d90d4976ab6f71465a4ad6f36880bcc3dc9d6ed45910056d8f89a80f9d255e694605d0a1b7d788c67908460161a
SHA1 hash: d64fffdffaa1797f46acb549897617900bda16dd
MD5 hash: 629f60cc2fe0f834e8cf2af83fcb1e59
humanhash: sixteen-indigo-alabama-blue
File name:extract-1633590973.340585-HTTP-FxbP4DpEZShB8PfQ4__1.exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:470'528 bytes
First seen:2021-10-08 13:43:12 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 5b3a7ff4c096c62bf847fa169c79c586 (2 x RemcosRAT)
ssdeep 6144:6a4YiP1U/VOKRUz7mxE3oEhxv2gYnCLrbLM9iHul+jZ5mv9Qoj8lAOZZlvXI2FE3:6a4RU/U3AVE2gNrY9iH8+1YMfZlA9eG
Threatray 709 similar samples on MalwareBazaar
TLSH T13CA49E11B991C032D17212740D29FB759AFCBE212A22497B73D92D5BFE710D0FB2A663
File icon (PE):PE icon
dhash icon c4d48eaa8ad4d4f8 (1'000 x RemcosRAT, 1 x Worm.Ramnit, 1 x Vjw0rm)
Reporter c_APT_ure
Tags:exe md5:ff8c3736ac246c6ec8cb08a3cef7e0cc officialsw chickenkiller com RemcosRAT


Avatar
c_APT_ure
embedded EXE from
https://bazaar.abuse.ch/sample/a954c9f0b3b82dbe4e313537c77b681d3996605d57b55b3f0623b92b96ef1556

Intelligence

File Origin
# of uploads :
1
# of downloads :
354
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
extract-1633590973.340585-HTTP-FxbP4DpEZShB8PfQ4__1.exe
Verdict:
Malicious activity
Analysis date:
2021-10-08 13:48:18 UTC
Tags:
rat remcos keylogger
Link:
https://app.any.run/tasks/a6d4298c-de49-4992-b787-bdbfc3f7b96a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Remcos
Create hunting rule
Link:
https://www.capesandbox.com/analysis/196177/
Detection(s):
Win.Trojan.Remcos-9753190-0
Create hunting rule

Win.Trojan.Remcos-9841897-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Setting a keyboard event handler
Creating a file in the %AppData% subdirectories
Connection attempt to an infection source
DNS request
Connection attempt
Query of malicious DNS domain
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware keylogger packed remcos
Link:
https://www.filescan.io/uploads/61604b2db95458900cdf560f/reports/581b064c-0fe4-4982-b34b-d189e3b46c88/overview
Detection:
remcos
Create hunting rule
Link:
https://mwdb.cert.pl/sample/0bb25dccd5ee69b35f2c03c04b50ec23573929d193739becb1c623d32db64e4a/
Threat name:
Win32.Backdoor.Remcos
Create hunting rule
Status:
Malicious
First seen:
2021-10-08 13:44:15 UTC
AV detection:
22 of 27 (81.48%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bozf3tgv5zu3gxzmapaewuhmenltskorsnzzx3fryyr5glnwjzfa._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
1730338ca0fbfe0985bed5638fc8599a6dd38761ab8b89e3d8a076947a320028
RemcosRAT
226d0ea20dccb9f0b091d02ccacaec73b537fc9b61157eff759b74d742d48b00
RemcosRAT
4c60bb36a8789392f4d2c953f08dac0a0056e0c493a0584481ed3fd4a946cad7
RemcosRAT
6f476c63a6d699d1f0166313deb1e0f623c689882de8411bcd4f0b4f880526dd
RemcosRAT
772a319b31a1922eadd022f30aa60680e911f758d4c81c4dbf16614cf7791f0a
RemcosRAT
9a50c056a96999f841ea1ef7bb6674da47579f5cafe02e295c75e980b36219a9
RemcosRAT
b3e18d1026779e01b6bc834a8da488eeb669e5e366ef8d495c109c0f1424d3c1
RemcosRAT
b9c5a6059ee5150b5837e446196c4349571d80336b438056f687d7044cd246b9
RemcosRAT
bfd45ef21e21655c921b457242c1d4e05a1e979d0051a4195192d8e17b7bed38
RemcosRAT
e4b26e2c09188228c4db16281887a17e90baaf95c7b691fa75d05af9f79ff20a
RemcosRAT
+ 699 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:es rat
Link:
https://tria.ge/reports/211008-q1w5qseeb2/
Behaviour
Suspicious use of SetWindowsHookEx
Remcos
Malware Config
C2 Extraction:
Officialsw.chickenkiller.com:2310
official.ydns.eu:2310
hurricane.ydns.eu:2310
Unpacked files
SH256 hash:
0bb25dccd5ee69b35f2c03c04b50ec23573929d193739becb1c623d32db64e4a
MD5 hash:
629f60cc2fe0f834e8cf2af83fcb1e59
SHA1 hash:
d64fffdffaa1797f46acb549897617900bda16dd
Detections:
win_remcos_g0
Create hunting rule
Link:
https://www.unpac.me/results/2ee8047f-c36f-4447-88d4-a040dfd18541/
Malware family:
Remcos
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/0bb25dccd5ee/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Remcos
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/0bb25dccd5ee69b35f2c03c04b50ec23573929d193739becb1c623d32db64e4a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_RemcosRAT
Create hunting rule
Author:abuse.ch
Rule name:INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer
Create hunting rule
Author:ditekSHen
Description:detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Rule name:Remcos
Create hunting rule
Author:kevoreilly
Description:Remcos Payload
Rule name:remcos_rat
Create hunting rule
Author:jeFF0Falltrades
Rule name:REMCOS_RAT_variants
Create hunting rule
Rule name:REMCOS_RAT_variants
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

Visual Basic Script (vbs) vbs b9c5a6059ee5150b5837e446196c4349571d80336b438056f687d7044cd246b9

RemcosRAT

Executable exe 0bb25dccd5ee69b35f2c03c04b50ec23573929d193739becb1c623d32db64e4a

(this sample)

  
X
https://twitter.com/c_APT_ure/status/1446159052518604805
  
Dropped by
MD5 ff8c3736ac246c6ec8cb08a3cef7e0cc
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/196177/

Comments