MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0edea473c0fa74d8ed6544bcb1ed98addbba5d492d6afc0d7447e67709ffae4d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 15


Intelligence 15 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0edea473c0fa74d8ed6544bcb1ed98addbba5d492d6afc0d7447e67709ffae4d
SHA3-384 hash: 9bb9de9e2ef03224fa9c441e168a5267b160b8f95906f177cf8f8f4e921e1d7233ddcb22a9e7333a6e5678679fe1188b
SHA1 hash: e6e599309622ee0ed8169660aaa63cc24a17df0c
MD5 hash: 4d8fb305a1a34a4039aaf282864fd45e
humanhash: monkey-bluebird-seventeen-quiet
File name:image2021042GFREDS12322ERDQ1DOC03027382.exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:731'648 bytes
First seen:2022-06-14 07:50:23 UTC
Last seen:2022-06-14 08:56:44 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 12288:EVfmfiHbXZNDNnuDTSmMRiVpAmivauaryMqnH5bSrFYg6SC3A7JcoR3WTCJEh29t:EMyMwHkrFYgTCQ9cY6MrFFeM38t
Threatray 1'444 similar samples on MalwareBazaar
TLSH T1DBF4120137F81B85D4FD47F96474996047B1F666AC46EB2E8CC9E0CA2973F82CA0A653
TrID 64.2% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.5% (.SCR) Windows screen saver (13101/52/3)
9.2% (.EXE) Win64 Executable (generic) (10523/12/4)
5.7% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.9% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter abuse_ch
Tags:exe RAT RemcosRAT

Intelligence

File Origin
# of uploads :
2
# of downloads :
288
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
remcos
Create hunting rule
ID:
1
File name:
image2021042GFREDS12322ERDQ1DOC03027382.exe
Verdict:
Malicious activity
Analysis date:
2022-06-14 07:58:16 UTC
Tags:
remcos
Link:
https://app.any.run/tasks/0e98e6a6-1dbd-40f3-90f2-7ad14699caf5

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Remcos
Create hunting rule
Link:
https://www.capesandbox.com/analysis/279648/
Detection(s):
SecuriteInfo.com.Trojan.PWS.StealerNET.122.5025.3291.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Launching a process
Creating a process with a hidden window
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed shell32.dll
Link:
https://www.filescan.io/uploads/62a83e045aca718dcaf43eae/reports/a4dcc6b9-f8ff-4d46-bfaf-e8c2e95bd255/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
REMCOS
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/5831fe02-b253-498c-9a53-6c745f052fa8
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/1012646
Signature
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
C2 URLs / IPs found in malware configuration
Initial sample is a PE file and has a suspicious name
Malicious sample detected (through community Yara rule)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM3
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 645143 Sample: image2021042GFREDS12322ERDQ... Startdate: 14/06/2022 Architecture: WINDOWS Score: 88 27 Malicious sample detected (through community Yara rule) 2->27 29 Yara detected AntiVM3 2->29 31 Yara detected Remcos RAT 2->31 33 4 other signatures 2->33 7 image2021042GFREDS12322ERDQ1DOC03027382.exe 7 2->7         started        process3 file4 23 C:\Users\user\AppData\...\mezmlQYDGEu.exe, PE32 7->23 dropped 25 C:\Users\user\AppData\Local\...\tmpF037.tmp, XML 7->25 dropped 35 Uses schtasks.exe or at.exe to add and modify task schedules 7->35 37 Adds a directory exclusion to Windows Defender 7->37 11 powershell.exe 25 7->11         started        13 schtasks.exe 1 7->13         started        15 vbc.exe 7->15         started        17 4 other processes 7->17 signatures5 process6 process7 19 conhost.exe 11->19         started        21 conhost.exe 13->21         started       
Detection:
remcos
Create hunting rule
Link:
https://mwdb.cert.pl/sample/0edea473c0fa74d8ed6544bcb1ed98addbba5d492d6afc0d7447e67709ffae4d/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-06-14 07:51:12 UTC
File Type:
PE (.Net Exe)
Extracted files:
4
AV detection:
21 of 26 (80.77%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=b3pki46a7j2nr3lfis6ld3myvxn3uxkjfvvpydlui7thocp7vzgq._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
0b8ce3d491814d2e36d1f10e2deafca89470c738f3aabd8c6a4757e75bef7c01
RemcosRAT
7d86068523fe035aec83fcb57be4edc0bdca3000fa6046fb66ef246b20e15601
RemcosRAT
b69f04883131047159a3f3f13a7943ffdf43c742bc2a8994f7ef1f1a42c16eee
RemcosRAT
d3a21cede73947b114725d5d26f451d9d51d82ffece745f70416d1e844293109
RemcosRAT
f1aacaeca440e70a5892f3f1a1d59759c1bcc3c3a29b3d8e9730bb92ec7890d0
RemcosRAT
+ 1'434 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:cassandra-marble rat
Link:
https://tria.ge/reports/220614-jptf5scgcl/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Checks computer location settings
Uses the VBS compiler for execution
Remcos
Malware Config
C2 Extraction:
www.temmermerble.com:2404
Unpacked files
SH256 hash:
1838094cec6222bd75b3ec03c928617891eb7a50243c35ae44d6ed6958d3e357
MD5 hash:
93cc62efb93d3b18e8fe703b365f4ec0
SHA1 hash:
bc7f11191a77ed0611a99fb84e3fe543d5d0501c
Link:
https://www.unpac.me/results/c33e87fa-0070-4f5c-9266-b2c622289a11/
SH256 hash:
08eb469e46e2f6124d31e268d05198506aaaff7db62b8e0d689eff6d5aa6ae93
MD5 hash:
b5759eae31e4d5447643cb0f9f009b5f
SHA1 hash:
9a378d5fb78d9b42a34aaedd593935752172ca5b
Link:
https://www.unpac.me/results/c33e87fa-0070-4f5c-9266-b2c622289a11/
SH256 hash:
b303aa2b8ba76509f6a9f2981d6421be70f25c087fbbb2f83b709f603dfe8235
MD5 hash:
d071f139a25a8d948ce663f0b2f117df
SHA1 hash:
5a38f857f17b49e98fae09dea32767b0f3179b52
Detections:
win_remcos_auto
Create hunting rule
Link:
https://www.unpac.me/results/c33e87fa-0070-4f5c-9266-b2c622289a11/
SH256 hash:
2fe9852668ae6b7715a5c6f8764744f9cb2ef3163adf0f360728f628d42ce916
MD5 hash:
26bfda201145c515616dbb9243785084
SHA1 hash:
4133e7329a79766bbe670a398fdfb442eb70487d
Link:
https://www.unpac.me/results/c33e87fa-0070-4f5c-9266-b2c622289a11/
SH256 hash:
0edea473c0fa74d8ed6544bcb1ed98addbba5d492d6afc0d7447e67709ffae4d
MD5 hash:
4d8fb305a1a34a4039aaf282864fd45e
SHA1 hash:
e6e599309622ee0ed8169660aaa63cc24a17df0c
Link:
https://www.unpac.me/results/c33e87fa-0070-4f5c-9266-b2c622289a11/
Malware family:
Remcos
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/0edea473c0fa/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0edea473c0fa74d8ed6544bcb1ed98addbba5d492d6afc0d7447e67709ffae4d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer
Create hunting rule
Author:ditekSHen
Description:detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Rule name:pe_imphash
Create hunting rule
Rule name:remcos_rat
Create hunting rule
Author:jeFF0Falltrades
Rule name:REMCOS_RAT_variants
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:win_remcos_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.remcos.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

Executable exe 0edea473c0fa74d8ed6544bcb1ed98addbba5d492d6afc0d7447e67709ffae4d

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/279648/

Comments