MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0d0cc505a458e4983da79246c321dfda6edc4d9b1f14e902ac13788a27c53afa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 18


Intelligence 18 IOCs YARA 20 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0d0cc505a458e4983da79246c321dfda6edc4d9b1f14e902ac13788a27c53afa
SHA3-384 hash: faf6628a6ae89bf163fd8a341ce9ea2f709a74f702b94b32431b6fdcc2135afeba938c29545e3a090b6be5356d0770b2
SHA1 hash: 155810faddf2f068fe49735bbd6a3a13a60c75c3
MD5 hash: a5e057f72b814ddcc71246b8dd092e2a
humanhash: failed-oven-mars-kansas
File name:0d0cc505a458e4983da79246c321dfda6edc4d9b1f14e902ac13788a27c53afa
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'010'176 bytes
First seen:2025-01-10 14:56:32 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'663 x AgentTesla, 19'478 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 24576:lG5oJaVtxpPhSo88M8taYVTwLknbBdrvmyzdKl83AXax:SvMAaYVTbnbfrv1z8lR
Threatray 4'443 similar samples on MalwareBazaar
TLSH T158250160264DE603D97A4BF90471F278177AAECA7C01D2068FD97CEB7936F950D086A3
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter adrian__luca
Tags:exe RemcosRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
402
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
0d0cc505a458e4983da79246c321dfda6edc4d9b1f14e902ac13788a27c53afa.exe
Verdict:
Malicious activity
Analysis date:
2025-01-10 15:16:33 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/39826070-3a3b-4da6-804b-f347bbdf24cf

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Trojan.PWS.Stealer.41891.20597.30064.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
97.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=678135341e9cdec7dbbb7e3a
Tags:
virus shell msil
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Сreating synchronization primitives
Creating a process with a hidden window
Creating a file in the %temp% directory
Launching a process
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
DNS request
Connection attempt
Adding an exclusion to Microsoft Defender
Enabling autorun by creating a file
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
obfuscated packed packed packer_detected
Link:
https://www.filescan.io/uploads/67813546cc92c77244bece4e/reports/1a4f301a-9014-4a90-b84c-1c34dfe6235b/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/0d0cc505a458e4983da79246c321dfda6edc4d9b1f14e902ac13788a27c53afa
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
REMCOS
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/e5dcaa06-9f2c-428f-9c89-072eacc1a443
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
rans.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1587729
Signature
Adds a directory exclusion to Windows Defender
AI detected suspicious sample
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Connects to many ports of the same IP (likely port scanning)
Contains functionality to register a low level keyboard hook
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Contains functionalty to change the wallpaper
Delayed program exit found
Found malware configuration
Injects a PE file into a foreign processes
Loading BitLocker PowerShell Module
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Scheduled temp file as task from temp location
Suricata IDS alerts for network traffic
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM3
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1587729 Sample: vQyKfYxzXB.exe Startdate: 10/01/2025 Architecture: WINDOWS Score: 100 44 decmainserver.webredirect.org 2->44 50 Suricata IDS alerts for network traffic 2->50 52 Found malware configuration 2->52 54 Malicious sample detected (through community Yara rule) 2->54 56 10 other signatures 2->56 8 RTdozXra.exe 5 2->8         started        11 vQyKfYxzXB.exe 7 2->11         started        signatures3 process4 file5 58 Antivirus detection for dropped file 8->58 60 Multi AV Scanner detection for dropped file 8->60 62 Contains functionalty to change the wallpaper 8->62 70 5 other signatures 8->70 14 schtasks.exe 1 8->14         started        16 RTdozXra.exe 8->16         started        36 C:\Users\user\AppData\Roaming\RTdozXra.exe, PE32 11->36 dropped 38 C:\Users\...\RTdozXra.exe:Zone.Identifier, ASCII 11->38 dropped 40 C:\Users\user\AppData\Local\...\tmp8902.tmp, XML 11->40 dropped 42 C:\Users\user\AppData\...\vQyKfYxzXB.exe.log, ASCII 11->42 dropped 64 Uses schtasks.exe or at.exe to add and modify task schedules 11->64 66 Adds a directory exclusion to Windows Defender 11->66 68 Injects a PE file into a foreign processes 11->68 18 powershell.exe 23 11->18         started        21 vQyKfYxzXB.exe 2 11->21         started        24 schtasks.exe 1 11->24         started        26 2 other processes 11->26 signatures6 process7 dnsIp8 28 conhost.exe 14->28         started        48 Loading BitLocker PowerShell Module 18->48 30 WmiPrvSE.exe 18->30         started        32 conhost.exe 18->32         started        46 decmainserver.webredirect.org 69.174.98.48, 45682, 49702, 49820 ASN-QUADRANET-GLOBALUS United States 21->46 34 conhost.exe 24->34         started        signatures9 process10
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/0d0cc505a458e4983da79246c321dfda6edc4d9b1f14e902ac13788a27c53afa
Detection:
remcos
Create hunting rule
Link:
https://mwdb.cert.pl/sample/0d0cc505a458e4983da79246c321dfda6edc4d9b1f14e902ac13788a27c53afa/
Threat name:
ByteCode-MSIL.Trojan.Taskun
Create hunting rule
Status:
Malicious
First seen:
2024-12-23 14:20:24 UTC
File Type:
PE (.Net Exe)
Extracted files:
17
AV detection:
21 of 24 (87.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=bugmkbneldsjqpnhsjdmgio73jxnytm3d4kosavmcn4iuj6fhl5a._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
unknown_loader_037
Create hunting rule
Similar samples:
3f2491926888db2c9d6c7b1a426ff41e1cd4a13bc922156a814b9fe3032ff809
RemcosRAT
70029840a2c10f707e5b6bee6a48c4c7fb1fc3efe79215d7bb01c5e2967848cb
RemcosRAT
d1b50fc6ce79320a88defef33baf6a51e30845bd13ab2b52f7925ba0b8f527cd
RemcosRAT
e67ae0c8bca17f912e1fdcc8dacac7e967ac9dfcfc031d944663043c99f32ea7
RemcosRAT
error
RemcosRAT
+ 4'433 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:hdyebf discovery execution rat
Link:
https://tria.ge/reports/250110-sbm7msxpcs/
Behaviour
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Checks computer location settings
Command and Scripting Interpreter: PowerShell
Remcos
Remcos family
Malware Config
C2 Extraction:
decmainserver.webredirect.org:45682
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/ea38e4ff-091f-443d-bcf5-393bee04eb4d
Unpacked files
SH256 hash:
a0f83c10648d669dc2542fd912f647c3c92de177dfdbe78613e8d92da8f50763
MD5 hash:
cc75b4f246304adcbbd79caca1f75f2a
SHA1 hash:
58c2cd00c1915baaf3af727f7885ad4e63d5b41e
Link:
https://www.unpac.me/results/d7ca4fc8-8bc0-4b97-b4fe-0092fdacce70/
SH256 hash:
927dccd801f3dffb9cd523e51aa38da8ab4dad8cd3df8efbc13103796291dccf
MD5 hash:
3b3b6a23831a8bb040cbf6050feec860
SHA1 hash:
567a7aca5a14ecc035bb6b3bbae1bda0286e86ba
Detections:
Remcos
Create hunting rule
win_remcos_auto
Create hunting rule
win_remcos_w0
Create hunting rule
malware_windows_remcos_rat
Create hunting rule
win_remcos_rat_unpacked
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer
Create hunting rule
Link:
https://www.unpac.me/results/d7ca4fc8-8bc0-4b97-b4fe-0092fdacce70/
Parent samples :
0b2b9a03881b2a49d79df2c6a19d12cf076a031080698b8c4bce87bb8252b277
f9b5a6befe0272cfa6fe717ac29a61d76bd340d1c564e179cb65975ac98b1f07
927dccd801f3dffb9cd523e51aa38da8ab4dad8cd3df8efbc13103796291dccf
0d0cc505a458e4983da79246c321dfda6edc4d9b1f14e902ac13788a27c53afa
SH256 hash:
f35e24439508fa1ce75d0fe436ea851a80b826c1e65be59b30fa5322925cf007
MD5 hash:
31426e1593f5c9d29adb1a5336ac2242
SHA1 hash:
1d830e59e2d9d2c78f20f4a7a8bb22ed3591e3c8
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/d7ca4fc8-8bc0-4b97-b4fe-0092fdacce70/
SH256 hash:
0d0cc505a458e4983da79246c321dfda6edc4d9b1f14e902ac13788a27c53afa
MD5 hash:
a5e057f72b814ddcc71246b8dd092e2a
SHA1 hash:
155810faddf2f068fe49735bbd6a3a13a60c75c3
Link:
https://www.unpac.me/results/d7ca4fc8-8bc0-4b97-b4fe-0092fdacce70/
Malware family:
Remcos
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/0d0cc505a458/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AgentTesla_DIFF_Common_Strings_01
Create hunting rule
Author:schmidtsz
Description:Identify partial Agent Tesla strings
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:golang_david_CSC846
Create hunting rule
Author:David
Description:CSC-846 Golang
Rule name:iexplorer_remcos
Create hunting rule
Author:iam-py-test
Description:Detect iexplorer being taken over by Remcos
Rule name:INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer
Create hunting rule
Author:ditekSHen
Description:detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:RansomPyShield_Antiransomware
Create hunting rule
Author:XiAnzheng
Description:Check for Suspicious String and Import combination that Ransomware mostly abuse(can create FP)
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:Remcos
Create hunting rule
Author:kevoreilly
Description:Remcos Payload
Rule name:REMCOS_RAT_variants
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Windows_Trojan_Remcos_b296e965
Create hunting rule
Author:Elastic Security
Reference:https://www.elastic.co/security-labs/exploring-the-ref2731-intrusion-set
Rule name:win_remcos_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.remcos.
Rule name:win_remcos_w0
Create hunting rule
Author:Matthew @ Embee_Research
Description:Detects strings present in remcos rat Samples.
Rule name:yarahub_win_remcos_rat_unpacked_aug_2023
Create hunting rule
Author:Matthew @ Embee_Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments