MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 12a5309b110e495c50dca3f04195e1f0395874f6103e0fb67e3a1f4f9ad142ca. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 17


Intelligence 17 IOCs YARA 12 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 12a5309b110e495c50dca3f04195e1f0395874f6103e0fb67e3a1f4f9ad142ca
SHA3-384 hash: a17c6edf0a699eb35e911198f8f694a390071f6531af94e3c3b043ffbb3468069b42242664542e43a37378cf426d6c2d
SHA1 hash: 262982d1d688dfb96b77bcb2fac91b16a8750a02
MD5 hash: a87b117a16b72275496d7966eb5cafc5
humanhash: black-bravo-lactose-sweet
File name:Absa.exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'029'632 bytes
First seen:2023-08-09 13:36:40 UTC
Last seen:2023-08-09 22:20:32 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'461 x Formbook, 12'202 x SnakeKeylogger)
ssdeep 24576:oIOu0YkTsMvF6dub1jo6ok1DfGQtiokwBXYvIRBfI:bQfs+8du5HDBtrbqwnfI
Threatray 2'429 similar samples on MalwareBazaar
TLSH T1982523023B8DA526CBED067B95A371450BFCF3B37C55D28B6DE0E8141E96390A065AF3
TrID 67.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
9.7% (.EXE) Win64 Executable (generic) (10523/12/4)
6.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.1% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter James_inthe_box
Tags:exe RemcosRAT

Intelligence

File Origin
# of uploads :
2
# of downloads :
326
Origin country :
US US
Vendor Threat Intelligence
Malware family:
remcos
Create hunting rule
ID:
1
File name:
Absa.exe
Verdict:
Malicious activity
Analysis date:
2023-08-09 14:37:35 UTC
Tags:
rat remcos keylogger
Link:
https://app.any.run/tasks/e589b422-8719-4b4f-b385-76556114721b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Remcos
Create hunting rule
Link:
https://www.capesandbox.com/analysis/441654/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.2257.25071.8488.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Сreating synchronization primitives
Running batch commands
Creating a process with a hidden window
Creating a file in the %AppData% directory
Launching a process
Creating a file
Using the Windows Management Instrumentation requests
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a system process
Gathering data
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/12a5309b110e495c50dca3f04195e1f0395874f6103e0fb67e3a1f4f9ad142ca
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
REMCOS
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/27b4b045-b8ec-4dac-a58e-51b3c18022ff
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1288595
Signature
.NET source code contains potential unpacker
Adds extensions / path to Windows Defender exclusion list
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Remcos
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Writes to foreign memory regions
Yara detected Costura Assembly Loader
Yara detected Remcos RAT
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1288595 Sample: Absa.exe Startdate: 09/08/2023 Architecture: WINDOWS Score: 100 72 Found malware configuration 2->72 74 Malicious sample detected (through community Yara rule) 2->74 76 Antivirus detection for URL or domain 2->76 78 9 other signatures 2->78 9 Absa.exe 1 6 2->9         started        13 Lepplsf.exe 4 2->13         started        15 Lepplsf.exe 3 2->15         started        process3 file4 60 C:\Users\user\AppData\Roaming\Lepplsf.exe, PE32 9->60 dropped 86 Writes to foreign memory regions 9->86 88 Adds extensions / path to Windows Defender exclusion list 9->88 90 Injects a PE file into a foreign processes 9->90 17 MSBuild.exe 3 3 9->17         started        22 cmd.exe 1 9->22         started        92 Multi AV Scanner detection for dropped file 13->92 94 Machine Learning detection for dropped file 13->94 24 cmd.exe 13->24         started        26 cmd.exe 15->26         started        signatures5 process6 dnsIp7 62 212.193.30.230, 3343 SPD-NETTR Russian Federation 17->62 64 79.110.49.161, 3343 OTAVANET-ASCZ Germany 17->64 58 C:\ProgramData\remcos\logs.dat, data 17->58 dropped 80 Installs a global keyboard hook 17->80 82 Adds extensions / path to Windows Defender exclusion list 22->82 28 powershell.exe 16 22->28         started        30 conhost.exe 22->30         started        32 Lepplsf.exe 24->32         started        35 conhost.exe 24->35         started        37 Lepplsf.exe 26->37         started        39 conhost.exe 26->39         started        file8 signatures9 process10 signatures11 66 Writes to foreign memory regions 32->66 68 Adds extensions / path to Windows Defender exclusion list 32->68 70 Injects a PE file into a foreign processes 32->70 41 cmd.exe 32->41         started        44 MSBuild.exe 32->44         started        46 cmd.exe 37->46         started        48 MSBuild.exe 37->48         started        process12 signatures13 84 Adds extensions / path to Windows Defender exclusion list 41->84 50 conhost.exe 41->50         started        52 powershell.exe 41->52         started        54 conhost.exe 46->54         started        56 powershell.exe 46->56         started        process14
Detection:
remcos
Create hunting rule
Link:
https://mwdb.cert.pl/sample/12a5309b110e495c50dca3f04195e1f0395874f6103e0fb67e3a1f4f9ad142ca/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Malicious
First seen:
2023-08-09 09:44:43 UTC
File Type:
PE (.Net Exe)
Extracted files:
4
AV detection:
13 of 38 (34.21%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ckstbgyrbzevyug4upyedfpb6a4vq5hwca7a7nt6hipu7gwrilfa._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
14537704270b4f5374035799ad456b43bd9c003a4f705f37a6aee9f3a80a03f8
RemcosRAT
1f5f16708303943ac08ec370899c73caffc0a0cebbe4e4c32f7374f94c944408
RemcosRAT
36f8e4eb768b6f4bcb732179cfb4d8795452c285d565e4fc4998455de0006f51
RemcosRAT
3f0f7847996e9d8ef9f875c1c20dafd17ecb2a3eee860b2d08ac5eabab631b4d
RemcosRAT
90199e919b753c405f76a253d0994209b7231e9f1927d9af81e6bc022f93235b
RemcosRAT
d5a1b80f534871efd0a4f5d8f2dd169e8e35751ef0416dcd4af929daa82e5687
RemcosRAT
ec786af55576e020a5cd63cefc5458b46868055b6222e255d35b4ec4689cbfd6
RemcosRAT
f197a58d2ac9ac937c5d417d0800d4804a80402395cdde0fe42dec0931674da4
RemcosRAT
+ 2'419 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:remotehost persistence rat
Link:
https://tria.ge/reports/230809-qws8aadc5y/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Remcos
Malware Config
C2 Extraction:
212.193.30.230:3343
79.110.49.161:3343
Unpacked files
SH256 hash:
ce80a9cfcc44a099e60360dcc8932a168a284db4519bdcb5a7a784426b687625
MD5 hash:
8695b669fb0baf417ca5a1ea27cbbb8a
SHA1 hash:
ff896b9206b6431027c77693ac2ea008ae5bc7e1
Link:
https://www.unpac.me/results/ab048e67-9b7c-42b6-b736-1faf155fc111/
SH256 hash:
586fb6890cb801df0df51c9f69a52e54445bbbde4ac20155353fdb43faae7504
MD5 hash:
f1441f0a36ab4f948a4a1936d6cb374e
SHA1 hash:
f1a9b476a0c24143d8cd5897fba395cd18804893
Detections:
Remcos
Create hunting rule
win_remcos_auto
Create hunting rule
Link:
https://www.unpac.me/results/ab048e67-9b7c-42b6-b736-1faf155fc111/
Parent samples :
90199e919b753c405f76a253d0994209b7231e9f1927d9af81e6bc022f93235b
f197a58d2ac9ac937c5d417d0800d4804a80402395cdde0fe42dec0931674da4
12a5309b110e495c50dca3f04195e1f0395874f6103e0fb67e3a1f4f9ad142ca
SH256 hash:
19efdf03cb94895935225795f68bb9abfded1869687367013b8b4eee3cc99372
MD5 hash:
4e29f75c0c51b9dec76955f0382d9541
SHA1 hash:
4899aa8e3f57339cbaec8faab777897a76fe1c3a
Link:
https://www.unpac.me/results/ab048e67-9b7c-42b6-b736-1faf155fc111/
SH256 hash:
7423e724bdb25223ff754d05f0a804256dfc96d683d0b3f9e8398a9240ded0a2
MD5 hash:
818faaa8e5e6924d37bab59987bf70ab
SHA1 hash:
1e845128d119054909a7ec960dc44d9a7832fa38
Link:
https://www.unpac.me/results/ab048e67-9b7c-42b6-b736-1faf155fc111/
SH256 hash:
12a5309b110e495c50dca3f04195e1f0395874f6103e0fb67e3a1f4f9ad142ca
MD5 hash:
a87b117a16b72275496d7966eb5cafc5
SHA1 hash:
262982d1d688dfb96b77bcb2fac91b16a8750a02
Link:
https://www.unpac.me/results/ab048e67-9b7c-42b6-b736-1faf155fc111/
Malware family:
Remcos
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/12a5309b110e/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/12a5309b110e495c50dca3f04195e1f0395874f6103e0fb67e3a1f4f9ad142ca

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:iexplorer_remcos
Create hunting rule
Author:iam-py-test
Description:Detect iexplorer being taken over by Remcos
Rule name:INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
Create hunting rule
Author:ditekSHen
Description:Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Remcos
Create hunting rule
Author:kevoreilly
Description:Remcos Payload
Rule name:REMCOS_RAT_variants
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Windows_Trojan_Remcos_b296e965
Create hunting rule
Author:Elastic Security
Rule name:win_remcos_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.remcos.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/441654/
  
URLhaus
https://urlhaus.abuse.ch/url/2703367/

Comments