MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1f350a9bcaccdb51ef9e784c123fb27099be181fcb39f9bac5130c4cedc190b1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemcosRAT

Vendor detections: 16

Intelligence 16 IOCs YARA 16 File information Comments

SHA256 hash:	1f350a9bcaccdb51ef9e784c123fb27099be181fcb39f9bac5130c4cedc190b1
SHA3-384 hash:	a42a3cf7b60f383fdc2f3512aad1f7f1cd5f8a4679a8319a5fbb9ebc857d59988caf7d0ea6c0a70724e347d35dbd60af
SHA1 hash:	ae6d0d5659090b795198ec6ee4e1072890d1785a
MD5 hash:	5779ae9ecf6ce4d3bb7c5e59d809c05c
humanhash:	earth-oxygen-monkey-nine
File name:	05-30-SO# 5483 (SO+INV+PKW) - 531結關KEE-LAX cfs SO# 5483的 ISF (10+2) data.scr
Download:	download sample
Signature	RemcosRAT Create hunting rule
File size:	975'872 bytes
First seen:	2024-05-30 17:25:57 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'737 x AgentTesla, 19'596 x Formbook, 12'241 x SnakeKeylogger)
ssdeep	24576:xcV0G+pAuwIZbV6pCvQ2VedTp58iVLEo:6V0XpAujbV6p4VeJQM4o
Threatray	4'142 similar samples on MalwareBazaar
TLSH	T17225230CB86D892BC6E98AF506EBCD824BF3702B7625F4DC5DE0414D39F27608694B5B
TrID	61.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 11.1% (.SCR) Windows screen saver (13097/50/3) 8.9% (.EXE) Win64 Executable (generic) (10523/12/4) 5.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 3.8% (.EXE) Win32 Executable (generic) (4504/4/1)
File icon (PE):
dhash icon	0000000000000000 (872 x AgentTesla, 496 x Formbook, 296 x RedLineStealer)
Reporter	threatcat_ch
Tags:	exe RemcosRAT

Intelligence

File Origin

# of uploads :

# of downloads :

374

Origin country :

Vendor Threat Intelligence

Malware family:

remcos

ID:

File name:

1f350a9bcaccdb51ef9e784c123fb27099be181fcb39f9bac5130c4cedc190b1.exe

Verdict:

Malicious activity

Analysis date:

2024-05-30 17:28:59 UTC

Tags:

remcos

Link:

https://app.any.run/tasks/5804952f-7ff3-4abe-a957-ef3530c43bf2

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

SecuriteInfo.com.Trojan.PackedNET.2872.31391.24743.UNOFFICIAL

Verdict:

Malicious

Score:

95.7%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6658b6be20ad30d287677372win7simulatehigh_evasion

Tags:

Stealth Remcos

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Searching for synchronization primitives

Launching the default Windows debugger (dwwin.exe)

Searching for the window

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/1f350a9bcaccdb51ef9e784c123fb27099be181fcb39f9bac5130c4cedc190b1

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

REMCOS

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/611c419e-55a6-41fc-8775-388952dc03c9

Result

Threat name:

Remcos

Detection:

malicious

Classification:

rans.troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1449734

Signature

.NET source code contains potential unpacker

AI detected suspicious sample

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Contains functionality to bypass UAC (CMSTPLUA)

Contains functionality to register a low level keyboard hook

Contains functionality to steal Chrome passwords or cookies

Contains functionality to steal Firefox passwords or cookies

Contains functionalty to change the wallpaper

Delayed program exit found

Found malware configuration

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AntiVM3

Yara detected Remcos RAT

Yara detected UAC Bypass using CMSTP

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/1f350a9bcaccdb51ef9e784c123fb27099be181fcb39f9bac5130c4cedc190b1

Detection:

remcos

Link:

https://mwdb.cert.pl/sample/1f350a9bcaccdb51ef9e784c123fb27099be181fcb39f9bac5130c4cedc190b1/

Threat name:

Win32.Backdoor.Remcos

Status:

Malicious

First seen:

2024-05-30 03:19:00 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

20 of 24 (83.33%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=d42qvg6kztnvd346pbgbep5socm34ga7zm47towfcmgez3obscyq._file

Verdict:

malicious

Label(s):

remcos

RemcosRAT

15db2223703c591a0bab4f8e019f4787866ebaa27f9cab17cf350112b33cd196

RemcosRAT

3e32447ea3b5f07c7f6a180269f5443378acb32c5d0e0bf01a5e39264f691587

RemcosRAT

472a8fbff35cdda49a870d372fa6da50defd8480348438e245f11aad954642d1

RemcosRAT

728e6e2b92f46c84865ec974f440661f40b8df3f328a7c2bd842c1c697f6c992

RemcosRAT

a739f75be90696d11429b7b5003af6ae0318009bdabdecdcd49b18d80c60d946

RemcosRAT

b89f11149cf87734d5e56b24e4b6a604ba3c10a4bcb5ca6567a9f6c595c6a4ab

RemcosRAT

fcc20fe90b357bafc8ac88a33981885be904b1ce430a4ec8b8aed5caa357df92

RemcosRAT

+ 4'132 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/240530-vzt17seh2z/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Program crash

Unpacked files

SH256 hash:

1a1de9f3fe4c3a7ea7cd547cdd9d78b3873d6e243e544e5bb647452d6d9f6cfe

MD5 hash:

ceb52a5c98659e8905ea76737fe00c01

SHA1 hash:

bb7b30ff84d6aa26eaa0021c9fa3cd2c5a08e694

Link:

https://www.unpac.me/results/7f3c3f4f-4d02-4adf-a3b6-241f4c92500e/

SH256 hash:

25b5214317428b6661d063585c9de0ceb173e0cbf529069873599ac09f179ae9

MD5 hash:

a09ba49a164d02715cea9498b85dadb3

SHA1 hash:

5cb0c737d9fb738c36ca64082b53cd2d816b6e8b

Link:

https://www.unpac.me/results/7f3c3f4f-4d02-4adf-a3b6-241f4c92500e/

Parent samples :

6379fc2cce3608db3ed95f85abf8e7391890b839c151224cca1dfc64c545b4d1
655a38b1686aa4f75f6dd4f2b59c8e9e09cde9997b46bafbe4e3dee38d859c99

SH256 hash:

f3e67cd16e8a9765189d41fc2c9d727f22e371203e9fcc1f71c385e0b2104409

MD5 hash:

df0ffd65c6a5e687dce0f4288fdd4c04

SHA1 hash:

34fc0a295ea847c8ae6c9acd37780f8ee37c9aa1

Link:

https://www.unpac.me/results/7f3c3f4f-4d02-4adf-a3b6-241f4c92500e/

SH256 hash:

69dd751153f6ae4f2c008b12bcbf20b1328be9e0bda45f08eb8f32a837f34ba5

MD5 hash:

e47f6f1f5e743fdbf9d6579b96748a2b

SHA1 hash:

21dbce7b186f72c69647fce6aa0b5cf403aa87c4

Detections:

Remcos

win_remcos_w0

win_remcos_auto

malware_windows_remcos_rat

INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM

Link:

https://www.unpac.me/results/7f3c3f4f-4d02-4adf-a3b6-241f4c92500e/

Parent samples :

866de3bdc1cc207c818212511641cdf5e6220f304619a26b5e9cb2d2b9c8a309
b27ccf7bb556e1f332c8feb3a12f6f3c4b0ba949c059cdc3a1bdd416fb87921e
ac28e104b06d7025bab07468070e74b3ea0017b34d25e48150b6c55f8ffda4bf
69dd751153f6ae4f2c008b12bcbf20b1328be9e0bda45f08eb8f32a837f34ba5
1f350a9bcaccdb51ef9e784c123fb27099be181fcb39f9bac5130c4cedc190b1

SH256 hash:

1f350a9bcaccdb51ef9e784c123fb27099be181fcb39f9bac5130c4cedc190b1

MD5 hash:

5779ae9ecf6ce4d3bb7c5e59d809c05c

SHA1 hash:

ae6d0d5659090b795198ec6ee4e1072890d1785a

Link:

https://www.unpac.me/results/7f3c3f4f-4d02-4adf-a3b6-241f4c92500e/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Remcos

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/1f350a9bcaccdb51ef9e784c123fb27099be181fcb39f9bac5130c4cedc190b1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	iexplorer_remcos Create hunting rule
Author:	iam-py-test
Description:	Detect iexplorer being taken over by Remcos

Rule name:	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM Create hunting rule
Author:	ditekSHen
Description:	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)

Rule name:	maldoc_find_kernel32_base_method_1 Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	Remcos Create hunting rule
Author:	kevoreilly
Description:	Remcos Payload

Rule name:	REMCOS_RAT_variants Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	ThreadControl__Context Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	Windows_Trojan_Remcos_b296e965 Create hunting rule
Author:	Elastic Security
Reference:	https://www.elastic.co/security-labs/exploring-the-ref2731-intrusion-set

Rule name:	win_remcos_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	Detects win.remcos.

Rule name:	win_remcos_w0 Create hunting rule
Author:	Matthew @ Embee_Research
Description:	Detects strings present in remcos rat Samples.

Rule name:	yarahub_win_remcos_rat_unpacked_aug_2023 Create hunting rule
Author:	Matthew @ Embee_Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

exe 1f350a9bcaccdb51ef9e784c123fb27099be181fcb39f9bac5130c4cedc190b1

(this sample)

Delivery method

Distributed via e-mail attachment

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample