MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1bcb5256d3c0ac49ce2b13c2638d2a795f6cdf77591d29cb01d0b3731615470b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 7


Intelligence 7 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1bcb5256d3c0ac49ce2b13c2638d2a795f6cdf77591d29cb01d0b3731615470b
SHA3-384 hash: 89289fb57a203b5e7e87a8dd5507a21d8d846dca8c988a936541b990be756fb2fdb94645294048803bffb74aa1fe057a
SHA1 hash: 337984712bcb8e1ed775008a104013ec171da0e9
MD5 hash: c396a92cfb2646cde0b781fc5e65bc16
humanhash: carpet-michigan-eleven-hot
File name:Enquiry MW886079 ( Flowstar.CO.UK ).exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:923'136 bytes
First seen:2021-10-18 09:32:08 UTC
Last seen:2021-10-18 13:54:00 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:klsbGk4pRmXXukpDwQvPlSHWh9CjPCXhnAJMqUNtSD:kCGVRmEsS26m2JcN
Threatray 916 similar samples on MalwareBazaar
TLSH T1D815E12B26C557F0D1BA8B75A7B805E813F0A61FC312E7BA7D9502F4CE10A4A55236F3
Reporter GovCERT_CH
Tags:exe RemcosRAT

Intelligence

File Origin
# of uploads :
2
# of downloads :
179
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/198090/
Result
Verdict:
Clean
Maliciousness:
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/616d3f51db358dd15ebef045/reports/5bc177bc-f340-45d4-acfa-6843f6dd203b/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/20838192-50c2-4ff0-968d-6d5ae05e16ef
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/872114
Signature
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Creates an undocumented autostart registry key
Delayed program exit found
Detected Remcos RAT
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Uses dynamic DNS services
Writes to foreign memory regions
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 504542 Sample: Enquiry MW886079 ( Flowstar... Startdate: 18/10/2021 Architecture: WINDOWS Score: 100 54 Found malware configuration 2->54 56 Malicious sample detected (through community Yara rule) 2->56 58 Multi AV Scanner detection for submitted file 2->58 60 6 other signatures 2->60 8 Enquiry MW886079 ( Flowstar.CO.UK ).exe 15 7 2->8         started        process3 dnsIp4 48 pastebin.pl 168.119.93.163, 443, 49755, 49758 HETZNER-ASDE Germany 8->48 36 C:\Users\user\AppData\Roaming\csscr.exe, PE32 8->36 dropped 38 C:\Users\user\AppData\...\AddInProcess32.exe, PE32 8->38 dropped 40 C:\Users\user\...\csscr.exe:Zone.Identifier, ASCII 8->40 dropped 42 Enquiry MW886079 (...tar.CO.UK ).exe.log, ASCII 8->42 dropped 74 Hides that the sample has been downloaded from the Internet (zone.identifier) 8->74 13 csscr.exe 14 5 8->13         started        18 cmd.exe 1 8->18         started        file5 signatures6 process7 dnsIp8 50 192.168.2.1 unknown unknown 13->50 52 pastebin.pl 13->52 44 C:\Users\user\AppData\Local\Temp\lssc.exe, PE32 13->44 dropped 76 Multi AV Scanner detection for dropped file 13->76 78 Machine Learning detection for dropped file 13->78 80 Writes to foreign memory regions 13->80 82 2 other signatures 13->82 20 AddInProcess32.exe 2 2 13->20         started        24 lssc.exe 2 13->24         started        26 lssc.exe 1 13->26         started        28 reg.exe 1 1 18->28         started        30 conhost.exe 18->30         started        file9 signatures10 process11 dnsIp12 46 hadrqlo.ddns.net 5.39.15.166, 4301, 49763 OVHFR France 20->46 62 Contains functionality to steal Chrome passwords or cookies 20->62 64 Contains functionality to inject code into remote processes 20->64 66 Contains functionality to steal Firefox passwords or cookies 20->66 72 2 other signatures 20->72 68 Multi AV Scanner detection for dropped file 24->68 32 lssc.exe 24->32         started        34 lssc.exe 26->34         started        70 Creates an undocumented autostart registry key 28->70 signatures13 process14
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1bcb5256d3c0ac49ce2b13c2638d2a795f6cdf77591d29cb01d0b3731615470b/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-10-18 05:53:51 UTC
AV detection:
15 of 45 (33.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dpfvevwtycwettrlcpbghdjkpfpwzx3xleostsyb2czxgfqvi4fq._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
0bb25dccd5ee69b35f2c03c04b50ec23573929d193739becb1c623d32db64e4a
RemcosRAT
1730338ca0fbfe0985bed5638fc8599a6dd38761ab8b89e3d8a076947a320028
RemcosRAT
502f18997fa73c5af97c3f8f3cd7a8a12d7d648642bd238b4eb15c0457e879a1
RemcosRAT
71f0524220c02e27c282f118bd1da387695c2d805934cb4bf1362f8f1f5b0c5c
RemcosRAT
75d92595eacd434de03308b953df7cb12ae082d15093378a9d66814a41c92622
RemcosRAT
772a319b31a1922eadd022f30aa60680e911f758d4c81c4dbf16614cf7791f0a
RemcosRAT
96a78dc8ece8e56802dc93e396df810fa6673a344b81d4c5c3cac82809733865
RemcosRAT
9a50c056a96999f841ea1ef7bb6674da47579f5cafe02e295c75e980b36219a9
RemcosRAT
a7f4245d63e1dd21c5af3e0ddf682ac517eda484bf6650f3e0d5d856f4cc68fa
RemcosRAT
ed78db064dfb4ae791498b2d08410a69bdad684ff709319d179c2383dd8e2f1c
RemcosRAT
+ 906 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:remotehost persistence rat
Link:
https://tria.ge/reports/211018-lkfetsecbj/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Suspicious use of SetThreadContext
Executes dropped EXE
Modifies WinLogon for persistence
Remcos
Malware Config
C2 Extraction:
hadrqlo.ddns.net:4301
Unpacked files
SH256 hash:
1bcb5256d3c0ac49ce2b13c2638d2a795f6cdf77591d29cb01d0b3731615470b
MD5 hash:
c396a92cfb2646cde0b781fc5e65bc16
SHA1 hash:
337984712bcb8e1ed775008a104013ec171da0e9
Link:
https://www.unpac.me/results/6eef2904-7c8b-4334-a46d-aa02e47418ff/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/1bcb5256d3c0/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/1bcb5256d3c0ac49ce2b13c2638d2a795f6cdf77591d29cb01d0b3731615470b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

Executable exe 1bcb5256d3c0ac49ce2b13c2638d2a795f6cdf77591d29cb01d0b3731615470b

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/198090/

Comments