MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1e2fa46ce543aaa0b325f1fa8c767d4e6b50f63b9c9291c28798579b04bab1b5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 15


Intelligence 15 IOCs YARA 17 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1e2fa46ce543aaa0b325f1fa8c767d4e6b50f63b9c9291c28798579b04bab1b5
SHA3-384 hash: 1a5bd0110353506bc80c6472df79c7efa8846687848191c34c1b2251dec72d1e88ebaab72420f52f0860c4aad4bcd853
SHA1 hash: 94acb86baafa677099f4bbee3cc049af4648b1e8
MD5 hash: 250fb98bb56366824228fbce1a920192
humanhash: golf-glucose-papa-jersey
File name:SecuriteInfo.com.Trojan.PackedNET.1761.25543.25620
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:835'584 bytes
First seen:2023-01-11 14:38:31 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'653 x AgentTesla, 19'464 x Formbook, 12'205 x SnakeKeylogger)
ssdeep 12288:b3qbhEpE1AVxXzutG7LNr1zpd+f49z0MUDUTIp+iTkV2ghVUxxfpm+8ubkw:b3+EpGhohZT19z1UUTO+Ib4+bkw
Threatray 5'391 similar samples on MalwareBazaar
TLSH T10E05014F48D0F510FFD82574C34269DD0A672F015AF6E99F9C933C6F2A209EC6A9468B
TrID 69.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.0% (.EXE) Win64 Executable (generic) (10523/12/4)
6.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.2% (.EXE) Win32 Executable (generic) (4505/5/1)
1.9% (.EXE) Win16/32 Executable Delphi generic (2072/23)
Reporter SecuriteInfoCom
Tags:exe RemcosRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
188
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.Trojan.PackedNET.1761.25543.25620
Verdict:
Malicious activity
Analysis date:
2023-01-11 14:41:48 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/4debcfbc-e65f-4c8a-99d5-f1eff1b4d917

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Remcos
Create hunting rule
Link:
https://www.capesandbox.com/analysis/351971/
Detection(s):
Can't access file ERROR
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a process
Creating a process with a hidden window
Verdict:
No Threat
Threat level:
  2/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/63beca09dde391056ac2080c/reports/acb9754c-a4bf-42bb-8469-8868d6311435/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
REMCOS
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/7f8c2745-7fa2-4625-af97-4c4aff5e6484
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1149641
Signature
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
C2 URLs / IPs found in malware configuration
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Remcos
Sigma detected: Scheduled temp file as task from temp location
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM3
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 782373 Sample: SecuriteInfo.com.Trojan.Pac... Startdate: 11/01/2023 Architecture: WINDOWS Score: 100 52 Malicious sample detected (through community Yara rule) 2->52 54 Sigma detected: Scheduled temp file as task from temp location 2->54 56 Multi AV Scanner detection for submitted file 2->56 58 7 other signatures 2->58 7 SecuriteInfo.com.Trojan.PackedNET.1761.25543.25620.exe 7 2->7         started        11 OLCJwVCXT.exe 5 2->11         started        process3 file4 36 C:\Users\user\AppData\Roaming\OLCJwVCXT.exe, PE32 7->36 dropped 38 C:\Users\...\OLCJwVCXT.exe:Zone.Identifier, ASCII 7->38 dropped 40 C:\Users\user\AppData\Local\...\tmp2447.tmp, XML 7->40 dropped 42 SecuriteInfo.com.T...25543.25620.exe.log, ASCII 7->42 dropped 60 Uses schtasks.exe or at.exe to add and modify task schedules 7->60 62 Adds a directory exclusion to Windows Defender 7->62 13 SecuriteInfo.com.Trojan.PackedNET.1761.25543.25620.exe 2 16 7->13         started        18 powershell.exe 21 7->18         started        20 powershell.exe 21 7->20         started        22 schtasks.exe 1 7->22         started        64 Multi AV Scanner detection for dropped file 11->64 66 Machine Learning detection for dropped file 11->66 24 schtasks.exe 1 11->24         started        26 OLCJwVCXT.exe 11->26         started        signatures5 process6 dnsIp7 46 45.139.105.174, 10929, 49718 CMCSUS Italy 13->46 48 geoplugin.net 178.237.33.50, 49719, 80 ATOM86-ASATOM86NL Netherlands 13->48 50 10.9.0.26, 10929 unknown unknown 13->50 44 C:\ProgramData\remcos\logs.dat, data 13->44 dropped 68 Installs a global keyboard hook 13->68 28 conhost.exe 18->28         started        30 conhost.exe 20->30         started        32 conhost.exe 22->32         started        34 conhost.exe 24->34         started        file8 signatures9 process10
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1e2fa46ce543aaa0b325f1fa8c767d4e6b50f63b9c9291c28798579b04bab1b5/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2023-01-11 14:39:09 UTC
File Type:
PE (.Net Exe)
Extracted files:
15
AV detection:
22 of 26 (84.62%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=dyx2i3hfiovkbmzf6h5iy5t5jzvvb5r3tsjjdquhtblzwbf2wg2q._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
18a39f6193c69dae7ea38aa9dd25fddabdb651c4276e242d0b585bd13c49c3a9
RemcosRAT
3e5978c46162ecb05c51d7fff9ec6786ac453fff4dba91d906f9ec2f764d87af
RemcosRAT
7001538a3316bf0f86e9730d0a38992357f4669d3a4a85e77f1ec42293499ff5
RemcosRAT
778ad2e8d477b0fc3ba8cbb0e3de025a6f101257c67efeb60f2bc5627996e028
RemcosRAT
a6655fefe6b0b32d5c94627d3b83a0d446fa329b162ac7f8409a1b8827b63abc
RemcosRAT
abe27f90a49a7e563fc39eb1e0da5c0327e490aefe6638fa4dfa50fea16c42d2
RemcosRAT
c8ce7d7a1b3511466f838f2b09f1a644ac2ceaa09f508a81a601cc5c576e18d4
RemcosRAT
cb7ffda616dbfb59cec05339b9bee2e7ecae48595545ee4e63d93e9751feb594
RemcosRAT
f5b86bcb2e58400f938e94c71a1b1e7b06d6e9bc1749fc1e6f999110e4fc9143
RemcosRAT
+ 5'381 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:remotehost rat
Link:
https://tria.ge/reports/230111-rz96mshb4t/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Checks computer location settings
Remcos
Malware Config
C2 Extraction:
10.9.0.26:10929
45.139.105.174:10929
127.0.0.1:10929
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/675c0de1-a75b-432d-9624-7bb561b602ed
Unpacked files
SH256 hash:
d5718cfc5ded3ac791f539fab3a5559384b2a1694a0dc689f58e98e57bed18aa
MD5 hash:
207f7ee2a146b265261dbb94a29b06a9
SHA1 hash:
c2d0954cd772f6d6e6c020796fe90f3aee4c18bb
Link:
https://www.unpac.me/results/a051882e-8fdb-40d7-a13f-50f31d42e2b0/
SH256 hash:
2e115b439ff20aac06a026afc2169b38b9a41d1fd38f2185e17ee4691960a402
MD5 hash:
9bfab0058ed9744c6e9cb37ca56a7d61
SHA1 hash:
7f4bcf9a625325cafe63f3b7e4dce472071e9603
Detections:
Remcos
Create hunting rule
win_remcos_auto
Create hunting rule
Link:
https://www.unpac.me/results/a051882e-8fdb-40d7-a13f-50f31d42e2b0/
Parent samples :
1e2fa46ce543aaa0b325f1fa8c767d4e6b50f63b9c9291c28798579b04bab1b5
6b8c08bdfd37a2535412abaab2caff3235b903a2f57d618a35806b98cba075cf
SH256 hash:
9b0ea07f997fe5e7db63b1088d99d099a7b4beaad7066ab0a5e50fff3c705c34
MD5 hash:
b0c843070a4881fdce21e5f3a0efdbe7
SHA1 hash:
6245e3c4cd1783767a00c44294e56dd6518e3e3b
Link:
https://www.unpac.me/results/a051882e-8fdb-40d7-a13f-50f31d42e2b0/
SH256 hash:
ff1b42ea7d56a37eae801adbddb7116f52a4664c0b41302736f522852edc2747
MD5 hash:
89ac57478044c57c7195943116a521e0
SHA1 hash:
1ff2bafeed795423e3538d810bda8e1e3fcdcfa5
Link:
https://www.unpac.me/results/a051882e-8fdb-40d7-a13f-50f31d42e2b0/
SH256 hash:
090ed535ae6b20445522ef4f11c797c766ab924004e68e9fff72df670d9e5afe
MD5 hash:
f585e2afa36ddfc2ada9e153625205de
SHA1 hash:
12bd74e033d10e4dccfef86eda7a240a0c3e528f
Link:
https://www.unpac.me/results/a051882e-8fdb-40d7-a13f-50f31d42e2b0/
SH256 hash:
1e2fa46ce543aaa0b325f1fa8c767d4e6b50f63b9c9291c28798579b04bab1b5
MD5 hash:
250fb98bb56366824228fbce1a920192
SHA1 hash:
94acb86baafa677099f4bbee3cc049af4648b1e8
Link:
https://www.unpac.me/results/a051882e-8fdb-40d7-a13f-50f31d42e2b0/
Malware family:
Remcos
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/1e2fa46ce543/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/1e2fa46ce543aaa0b325f1fa8c767d4e6b50f63b9c9291c28798579b04bab1b5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:iexplorer_remcos
Create hunting rule
Author:iam-py-test
Description:Detect iexplorer being taken over by Remcos
Rule name:INDICATOR_EXE_Packed_MPress
Create hunting rule
Author:ditekSHen
Description:Detects executables built or packed with MPress PE compressor
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer
Create hunting rule
Author:ditekSHen
Description:detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:QbotStuff
Create hunting rule
Author:anonymous
Rule name:Remcos
Create hunting rule
Author:kevoreilly
Description:Remcos Payload
Rule name:REMCOS_RAT_variants
Create hunting rule
Rule name:TeslaCryptPackedMalware
Create hunting rule
Rule name:Windows_Trojan_Remcos_b296e965
Create hunting rule
Author:Elastic Security
Rule name:win_remcos_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.remcos.
Rule name:yara_template
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/351971/

Comments