MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1b945f30cc3cff4673d9a29a7f865edf107b7bfb64e5da763672449ef94fb7b9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 12


Intelligence 12 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1b945f30cc3cff4673d9a29a7f865edf107b7bfb64e5da763672449ef94fb7b9
SHA3-384 hash: a3c5208262e08b5068cd93f7c942e43e089f2fcb477b9379cd84f0b87ca70143839c9fa1831b1890102d0295166fa590
SHA1 hash: d3f5d61bcf16222c57d5501ae86d3beea1e155ad
MD5 hash: 29b7085660f5c35ee210dd37d556737d
humanhash: oven-vegan-single-chicken
File name:Dringende RFQ_AP65425652_032421,pdf.exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:702'464 bytes
First seen:2021-08-03 11:23:55 UTC
Last seen:2021-08-03 12:18:04 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 1379487e213e9660a192f7f9b27f1132 (5 x RemcosRAT, 1 x Formbook, 1 x AveMariaRAT)
ssdeep 12288:CHuv6TaXda6yswPypNz+w5cUsCPFExCUaMliTE5p/YrfFyA:466ga6ys0Kz+wHpzUEoBYrt
Threatray 389 similar samples on MalwareBazaar
TLSH T10BE46DA9B1D089FFC25D65382C1AF6689A3AF92054DC5DE27DC80F549F39281307BC9E
dhash icon 484a4c66d32e2e8a (11 x RemcosRAT, 2 x Formbook, 2 x BitRAT)
Reporter lowmal3
Tags:exe RemcosRAT

Intelligence

File Origin
# of uploads :
2
# of downloads :
123
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Dringende RFQ_AP65425652_032421,pdf.exe
Verdict:
Malicious activity
Analysis date:
2021-08-03 11:27:50 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/5cd48b67-232a-4687-979b-dae638032fed

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Remcos
Create hunting rule
Link:
https://www.capesandbox.com/analysis/176015/
Detection(s):
SecuriteInfo.com.Trojan.Inject4.15035.4069.13086.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Sending a UDP request
DNS request
Connection attempt
Creating a file
Launching the default Windows debugger (dwwin.exe)
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
REMCOS
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/987b1380-d4a8-42d9-9042-be8b0beda65e
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/826083
Signature
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Creates a thread in another existing process (thread injection)
Delayed program exit found
Detected Remcos RAT
Found malware configuration
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Uses dynamic DNS services
Writes to foreign memory regions
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 458505 Sample: Dringende RFQ_AP65425652_03... Startdate: 03/08/2021 Architecture: WINDOWS Score: 100 26 blessedudoka.ddns.net 2->26 50 Found malware configuration 2->50 52 Malicious sample detected (through community Yara rule) 2->52 54 Detected Remcos RAT 2->54 56 7 other signatures 2->56 7 Glwxpjw.exe 16 2->7         started        11 Dringende RFQ_AP65425652_032421,pdf.exe 1 19 2->11         started        14 Glwxpjw.exe 16 2->14         started        signatures3 process4 dnsIp5 30 onedrive.live.com 7->30 40 2 other IPs or domains 7->40 58 Multi AV Scanner detection for dropped file 7->58 60 Writes to foreign memory regions 7->60 62 Allocates memory in foreign processes 7->62 16 mobsync.exe 7->16         started        32 onedrive.live.com 11->32 34 dm-files.fe.1drv.com 11->34 36 cm2kpw.dm.files.1drv.com 11->36 24 C:\Users\Public\Libraries\...behaviorgraphlwxpjw.exe, PE32 11->24 dropped 64 Creates a thread in another existing process (thread injection) 11->64 66 Injects a PE file into a foreign processes 11->66 19 ieinstal.exe 2 11->19         started        38 onedrive.live.com 14->38 42 2 other IPs or domains 14->42 22 dialer.exe 14->22         started        file6 signatures7 process8 dnsIp9 44 Contains functionality to steal Chrome passwords or cookies 16->44 46 Contains functionality to steal Firefox passwords or cookies 16->46 48 Delayed program exit found 16->48 28 blessedudoka.ddns.net 91.193.75.135, 4753 DAVID_CRAIGGG Serbia 19->28 signatures10
Detection:
remcos
Create hunting rule
Link:
https://mwdb.cert.pl/sample/1b945f30cc3cff4673d9a29a7f865edf107b7bfb64e5da763672449ef94fb7b9/
Threat name:
Win32.Backdoor.Remcos
Create hunting rule
Status:
Malicious
First seen:
2021-08-03 11:24:05 UTC
AV detection:
14 of 28 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dokf6mgmht7um46zuknh7bs634ihw673mts5u5rwojcj56kpw64q._file
Verdict:
malicious
Similar samples:
0a0f707663752fcee384add20de2ee2c3f2061781aa8f08266b155317eb4662d
RemcosRAT
10f675a780a5814df0a79b673213a2ed2989816a517797df5656551b0819789c
RemcosRAT
367fd8584be5901c9b262975ab5e5700e0e3010d697f1161b6aafabcc7f07d07
RemcosRAT
4a84faebc419ed0cddbc9e37b337a3090a01051d3ed7d1650c2845369b9a1d63
RemcosRAT
4c0c348d5fe6d35084087f5df83a5d5f15aa75a30b1dc37204f701383a7685eb
RemcosRAT
9619dd90b103cea6ed31462e70f2419900b0f943295a7b773a0a77504ade15ce
RemcosRAT
c0dbfce6d1904f32b39ef57d1f59595099171f5e038ad1003a9fc5f9c3ec92d2
RemcosRAT
e805423ef1971ad60f2cf93dd0845f3bc13fb5bce5dc3b3b3e39f56c4f9142e7
RemcosRAT
fad40e1841789cfbef3c9f09b4e557b928597506cd8b93d8eae51cef2ba3cf3f
RemcosRAT
+ 379 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:modiloader family:remcos botnet:son of grace persistence rat trojan
Link:
https://tria.ge/reports/210803-85k2j19hla/
Behaviour
Suspicious use of WriteProcessMemory
Adds Run key to start application
Blocklisted process makes network request
ModiLoader, DBatLoader
Remcos
Malware Config
C2 Extraction:
blessedudoka.ddns.net:4753
Unpacked files
SH256 hash:
c873bd224bbf6f82aa169f079016ebdf7690b40a7db5dd8cfefd26404a9d50ca
MD5 hash:
d328f4ade4dd3cd77b3c055c6a7a7937
SHA1 hash:
5d2437502c20efaadd44d27bd5f2f748bdb48512
Link:
https://www.unpac.me/results/495bbf17-aa30-4dbf-9a9b-37970061f3d4/
SH256 hash:
1b945f30cc3cff4673d9a29a7f865edf107b7bfb64e5da763672449ef94fb7b9
MD5 hash:
29b7085660f5c35ee210dd37d556737d
SHA1 hash:
d3f5d61bcf16222c57d5501ae86d3beea1e155ad
Link:
https://www.unpac.me/results/495bbf17-aa30-4dbf-9a9b-37970061f3d4/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1b945f30cc3cff4673d9a29a7f865edf107b7bfb64e5da763672449ef94fb7b9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_RemcosRAT
Create hunting rule
Author:abuse.ch
Rule name:INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer
Create hunting rule
Author:ditekSHen
Description:detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Rule name:Remcos
Create hunting rule
Author:kevoreilly
Description:Remcos Payload
Rule name:remcos_rat
Create hunting rule
Author:jeFF0Falltrades
Rule name:REMCOS_RAT_variants
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

Executable exe 1b945f30cc3cff4673d9a29a7f865edf107b7bfb64e5da763672449ef94fb7b9

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/176015/

Comments