MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1f710524e7365c5c9d80ee6c44ef274fd05f637a6524ec831fe4886dbede6678. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 6


Intelligence 6 IOCs YARA 17 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1f710524e7365c5c9d80ee6c44ef274fd05f637a6524ec831fe4886dbede6678
SHA3-384 hash: ae72d2d6fd0a6f4245cd3bcd0bba99789c7a1cde1d2b293d976908e3b0c6781484477993acac14d6ed7c779bfc6be479
SHA1 hash: b1a47772dcfdd6f2abd2e0ccf410937eda241456
MD5 hash: d509f13af941f7953a2b75af786e33ee
humanhash: north-helium-red-hydrogen
File name:RFQ110623.pdf.rar
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:363'369 bytes
First seen:2023-11-06 16:34:16 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:WaCgnVqMd4pp07X+9h+ATKbkCrdbyvyblSfhpSPeesZw24NySY:WaDq04pp0yfCrdbyqRShpSPc2fN1Y
TLSH T1C67423924D7007B2EA67EC307353C206B3970AAD84B5059D57B98BEF53C361F62369CA
TrID 80.0% (.ZIP) ZIP compressed archive (4000/1)
20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter malwarology
Tags:remcos zip

Intelligence

File Origin
# of uploads :
1
# of downloads :
122
Origin country :
US US
File Archive Information

This file archive contains 2 file(s), sorted by their relevance:

File name:RFQ110623.pdf
File size:6'947 bytes
SHA256 hash: 5a3b1f990a63526daa4a22b2d6caeb08e0d185a0225727fdbc13f91709604ff3
MD5 hash: d57cd3bd6921405dc502ca46b5aacf50
MIME type:application/pdf
Signature RemcosRAT
File name:RFQ110623.pdf .exe
File size:464'896 bytes
SHA256 hash: 0e8dfb4c4b15bffe7df07f0a9240c2287e23c149b465991da96b73eff7b8f903
MD5 hash: 291135e84ac4c935c00a15ab1ce04353
MIME type:application/x-dosexec
Signature RemcosRAT
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_Hideexe.4.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.11305.UNOFFICIAL
Create hunting rule

TwinWave.EvlZip.CVE-2023-38831WinRarWidowMaker.20230823.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
File Type:
PDF File
Link:
https://app.docguard.net/1f710524e7365c5c9d80ee6c44ef274fd05f637a6524ec831fe4886dbede6678/results/dashboard
Gathering data
Verdict:
Malicious
Labled as:
CVE-2023-38831
Link:
https://www.hybrid-analysis.com/sample/1f710524e7365c5c9d80ee6c44ef274fd05f637a6524ec831fe4886dbede6678
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/1f710524e7365c5c9d80ee6c44ef274fd05f637a6524ec831fe4886dbede6678
Details
Document With Few Pages
Document contains between one and three pages of content. Most malicious documents are sparse in page count.
Document With Minimal Content
Document contains less than 1 kilobyte of semantic information.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1f710524e7365c5c9d80ee6c44ef274fd05f637a6524ec831fe4886dbede6678/
Threat name:
Win32.Exploit.Generic
Create hunting rule
Status:
Suspicious
First seen:
2023-11-06 14:25:28 UTC
File Type:
Binary (Archive)
Extracted files:
51
AV detection:
9 of 38 (23.68%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=d5yqkjhhgzofzhma5zwej3zhj7if6y32musozay74seg3pw6mz4a._file
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/231106-t9yxgace3z/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1f710524e7365c5c9d80ee6c44ef274fd05f637a6524ec831fe4886dbede6678

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:iexplorer_remcos
Create hunting rule
Author:iam-py-test
Description:Detect iexplorer being taken over by Remcos
Rule name:INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
Create hunting rule
Author:ditekSHen
Description:Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:Remcos
Create hunting rule
Author:kevoreilly
Description:Remcos Payload
Rule name:REMCOS_RAT_variants
Create hunting rule
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Windows_Trojan_Remcos_b296e965
Create hunting rule
Author:Elastic Security
Rule name:Windows_Trojan_Smokeloader_3687686f
Create hunting rule
Author:Elastic Security
Rule name:Windows_Trojan_Smokeloader_ea14b2a5
Create hunting rule
Author:Elastic Security
Rule name:win_remcos_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.remcos.
Rule name:win_remcos_rat_unpacked
Create hunting rule
Author:Matthew @ Embee_Research
Description:Detects strings present in remcos rat Samples.
Rule name:win_remcos_w0
Create hunting rule
Author:Matthew @ Embee_Research
Description:Detects strings present in remcos rat Samples.
Rule name:yarahub_win_remcos_rat_unpacked_aug_2023
Create hunting rule
Author:Matthew @ Embee_Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

zip 1f710524e7365c5c9d80ee6c44ef274fd05f637a6524ec831fe4886dbede6678

(this sample)

RemcosRAT

Executable exe 0e8dfb4c4b15bffe7df07f0a9240c2287e23c149b465991da96b73eff7b8f903

  
Dropping
SHA256 0e8dfb4c4b15bffe7df07f0a9240c2287e23c149b465991da96b73eff7b8f903
  
Delivery method
Distributed via e-mail attachment
  
Dropping
MD5 291135e84ac4c935c00a15ab1ce04353

Comments