MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0c6fe2c0d46a37a9bfcad2e6716351ad62497bf91484be42f7928a539de29c42. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemcosRAT

Vendor detections: 7

Intelligence 7 IOCs YARA 5 File information Comments

SHA256 hash:	0c6fe2c0d46a37a9bfcad2e6716351ad62497bf91484be42f7928a539de29c42
SHA3-384 hash:	7fd516e122e5e7d5716b76de00574809f5f962b771dc4969fff9e57ea575988411122afcda711288eb46209e6f67e731
SHA1 hash:	6806cdc0f8d61ab1a36e60f74c725e6fc0ba0096
MD5 hash:	99e699809de0ea723d5f3ad3aeb81f13
humanhash:	idaho-pip-sierra-butter
File name:	HB23090003.iso
Download:	download sample
Signature	RemcosRAT Create hunting rule
File size:	143'360 bytes
First seen:	2023-09-01 12:31:58 UTC
Last seen:	Never
File type:	iso
MIME type:	application/x-iso9660-image
ssdeep	1536:mNqFIZsnSJ/y3VbGBv4jMZ5LGKqn3LvMM/vnwhxgY3H6K+i3:wsSJ/cCuwqTnwbgYX6Q
TLSH	T1F4E3E837B65A85B2C644573AC797600403E7E781A2B3D70A398ED35E5B033EA49CD72B
TrID	99.5% (.NULL) null bytes (2048000/1) 0.2% (.ATN) Photoshop Action (5007/6/1) 0.1% (.ISO) ISO 9660 CD image (2545/36/1) 0.0% (.BIN/MACBIN) MacBinary 1 (1033/5) 0.0% (.ABR) Adobe PhotoShop Brush (1002/3)
Reporter	cocaman
Tags:	iso

cocaman

Malicious email (T1566.001)
From: ""Martin Keller" <mendez@fekaautomotive.live>" (likely spoofed)
Received: "from mail0.fekaautomotive.live (unknown [208.123.119.145]) "
Date: "1 Sep 2023 10:43:02 -0700"
Subject: "Angebotsanforderung"
Attachment: "HB23090003.iso"

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	HB23090003.exe
File size:	81'408 bytes
SHA256 hash:	9bf55d8f3b892e6b8706ec526eaa51cc8a1a727b45759494e2e388979a5708b8
MD5 hash:	05492ba0dd021b81e573bcaf60a78faa
MIME type:	application/x-dosexec
Signature	RemcosRAT

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Win32.MalwareX-gen.18126.29297.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

context-iso greyware packed remcos

Link:

https://www.filescan.io/uploads/64f1d9c5b3b7d7c782d25dcd/reports/4958585b-f46e-4409-8bba-091f4346cd71/overview

Verdict:

Malicious

Labled as:

Possibl.80622A98

Link:

https://www.hybrid-analysis.com/sample/0c6fe2c0d46a37a9bfcad2e6716351ad62497bf91484be42f7928a539de29c42

Result

Verdict:

MALICIOUS

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/0c6fe2c0d46a37a9bfcad2e6716351ad62497bf91484be42f7928a539de29c42/

Threat name:

ByteCode-MSIL.Trojan.Generic

Status:

Suspicious

First seen:

2023-09-01 12:32:00 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

10 of 38 (26.32%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=brx6fqguni32tp6k2lthcy2rvvres67zcscl4qxxskffhhpctrba._file

Result

Malware family:

remcos

Score:

10/10

Tags:

family:remcos botnet:working persistence rat

Link:

https://tria.ge/reports/230901-rdt8asfa5y/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Adds Run key to start application

Remcos

Malware Config

C2 Extraction:

37.139.129.251:2404

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/0c6fe2c0d46a37a9bfcad2e6716351ad62497bf91484be42f7928a539de29c42

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	SUSP_EXE_in_ISO Create hunting rule
Author:	SECUINFRA Falcon Team
Description:	Detects ISO files that contains an Exe file. Does not need to be malicious
Reference:	Internal Research