MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1832adc7abac176460e3ffb917603da35bd135b1d0fcaca1591a5481845ff1d2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 8


Intelligence 8 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1832adc7abac176460e3ffb917603da35bd135b1d0fcaca1591a5481845ff1d2
SHA3-384 hash: be1dd4eb7a4a3e34d78488cf701f88705b75b9433d15902e0262b0dee2468e45ea7dab173f7c9a9c65c04e1417eae48f
SHA1 hash: 2de5dd5dabcd91adddd8630f65e57563af4ac748
MD5 hash: e3d4c06549e0e53f78ea7440218a06c3
humanhash: don-connecticut-dakota-jupiter
File name:Quote 0027632.vbs
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:388'904 bytes
First seen:2022-07-18 07:10:34 UTC
Last seen:Never
File type:Visual Basic Script (vbs) vbs
MIME type:text/plain
ssdeep 3072:cnt2+0nBcDiq+y1NZWutiGmqLgoh65mO5SQXdwoQbinp:cg+g+Di6NZWukG9god/mwoQbG
Threatray 14'504 similar samples on MalwareBazaar
TLSH T12684C5903B2A95840E7E0555B21DD3968F940652A3D6C7B10B42E6F9CB66033FB37E8F
Reporter abuse_ch
Tags:RemcosRAT vbs

Intelligence

File Origin
# of uploads :
1
# of downloads :
239
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/291490/
Detection(s):
SecuriteInfo.com.BehavesLike.VBS.Backdoor.fv.28559.26340.UNOFFICIAL
Create hunting rule

Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
cerberus
Link:
https://www.filescan.io/uploads/62d50803ef2b0e63a8216b8f/reports/ecfffe01-8b98-4bf2-b81a-3a980ed13679/overview
Result
Verdict:
UNKNOWN
Result
Threat name:
GuLoader, Remcos
Create hunting rule
Detection:
malicious
Classification:
evad.troj
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1035545
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Encrypted powershell cmdline option found
Multi AV Scanner detection for domain / URL
Tries to detect Any.run
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses dynamic DNS services
Very long command line found
Wscript starts Powershell (via cmd or directly)
Yara detected GuLoader
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1832adc7abac176460e3ffb917603da35bd135b1d0fcaca1591a5481845ff1d2/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dazk3r5lvqlwiyhd764royb5unn5cnnr2d6kzikzdjkidbc76hja._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
28455b1a0b29240e95877cff96528b3a196f0cf3a63d9980dc70349cdc0e1e74
RemcosRAT
56400d285883e72264ab693e17d3f94bb35df61618891768c8959932b5d9f140
RemcosRAT
576183a33f5247a852bc65a4dc4cbca5762bfbad1291a82572681f7075dc6123
RemcosRAT
6debeb4cbf5037ee3b4d23e3a005dc58ebb0f26ac5f5266e910187a66760a4a0
RemcosRAT
7a099c2a919928941a4357553300018cd8847760df7b17c2e7bde1daef328305
RemcosRAT
900274d5916f078ac30bedfc6b3bf5812c09de4cc1bdddd4e25d5efa1e3bb1c3
RemcosRAT
b07f08cbf908eb0d5c93679c8dca8438e4f185a70d675ad79184533dc6b4b262
RemcosRAT
b6cbbd914e6466a18364e387503ecb099cb0b497807a85a1f5a8fb5e2df13213
RemcosRAT
f0ee700515bcc19a59d301204ffe8d612a7b39b79960b950299fb673d0c52116
RemcosRAT
+ 14'494 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:guloader family:remcos botnet:my logs downloader persistence rat
Link:
https://tria.ge/reports/220718-hzx2msbdel/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Adds Run key to start application
Checks QEMU agent file
Checks computer location settings
Guloader,Cloudeye
Remcos
Malware Config
C2 Extraction:
tochukwu1122.ddns.net:6426
toshiba1122.duckdns.org:6426
Malware family:
GuLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/1832adc7abac/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1832adc7abac176460e3ffb917603da35bd135b1d0fcaca1591a5481845ff1d2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Guloader_VBScript
Create hunting rule
Author:Ankit Anubhav - ankitanubhav.info
Description:Detects GuLoader/CloudEye VBScripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

Visual Basic Script (vbs) vbs 1832adc7abac176460e3ffb917603da35bd135b1d0fcaca1591a5481845ff1d2

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/291490/

Comments