MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2059180bc9af3eb06e8db119c7384c62c623dc47ef4d8ab1dc59e16ff2ee0df9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemcosRAT

Vendor detections: 17

Intelligence 17 IOCs YARA 6 File information Comments 1

SHA256 hash:	2059180bc9af3eb06e8db119c7384c62c623dc47ef4d8ab1dc59e16ff2ee0df9
SHA3-384 hash:	b5d66bf09afd04bbc429e55074ba685faf3427da68565e5bb65fb9dfede4eb5a4dfaa209a23ac8969b3ddb2ddc8a5b0a
SHA1 hash:	6696b3e2db65f28ff630a3f84ab774bc1d14b269
MD5 hash:	82bf097650dda02747c83009b3c07612
humanhash:	mango-nevada-uniform-twenty
File name:	82bf097650dda02747c83009b3c07612
Download:	download sample
Signature	RemcosRAT Create hunting rule
File size:	86'016 bytes
First seen:	2022-08-23 11:58:13 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f79bdf7005a27b505da0a17f8329bd86 (10 x RemcosRAT)
ssdeep	1536:KpNEsaeiQl8TIqytzRJl+uiNuI7FFCPBsZcOzq1T35T/4DLeILtVo8V:KpNEaiQl2qouiNdFFCiZcOz+TJ/4veAt
TLSH	T1D783F707FE07C1F3E81102B20B553762AFBDEC231619A927C745C581EEB8D4AE4B567A
TrID	38.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 20.5% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 13.0% (.EXE) Win64 Executable (generic) (10523/12/4) 8.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 6.2% (.EXE) Win16 NE executable (generic) (5038/12/1)
File icon (PE):
dhash icon	d4a22b2e0792f0f0 (16 x RemcosRAT, 1 x NetWire)
Reporter	zbetcheckin
Tags:	32 exe RemcosRAT

Intelligence

File Origin

# of uploads :

# of downloads :

257

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

remcos

ID:

File name:

82bf097650dda02747c83009b3c07612

Verdict:

Malicious activity

Analysis date:

2022-08-23 12:04:49 UTC

Tags:

rat remcos

Link:

https://app.any.run/tasks/be763959-d664-496f-9fc9-eddfe219e9c7

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Remcos

Link:

https://www.capesandbox.com/analysis/300523/

Detection(s):

Win.Trojan.Remcos-9763891-0

Win.Malware.Mikey-6843399-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Creating a file

Creating a window

Sending a custom TCP request

Result

Malware family:

n/a

Score:

5/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/29772/overview

Behaviour

MalwareBazaar

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

REMCOS

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/cc4ad0a8-41d0-40d1-8eb5-db1fca86f03e

Result

Threat name:

Remcos

Detection:

malicious

Classification:

troj

Score:

80 / 100

Link:

https://www.joesandbox.com/analysis/1056202

Signature

Antivirus / Scanner detection for submitted sample

C2 URLs / IPs found in malware configuration

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Remcos RAT

Behaviour

Behavior Graph:

Download SVG

Detection:

remcos

Link:

https://mwdb.cert.pl/sample/2059180bc9af3eb06e8db119c7384c62c623dc47ef4d8ab1dc59e16ff2ee0df9/

Threat name:

Win32.Backdoor.Remcos

Status:

Malicious

First seen:

2022-08-22 19:42:38 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

24 of 26 (92.31%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=ebmrqc6jv47la3unwem4oocmmldchxch55gyvmo4lhqw74xobx4q._file

Verdict:

malicious

Label(s):

remcos

Result

Malware family:

remcos

Score:

10/10

Tags:

family:remcos botnet:remotehost

Link:

https://tria.ge/reports/220823-n5qgmsecfr/

Behaviour

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Malware Config

C2 Extraction:

192.168.1.4:2404

Unpacked files

SH256 hash:

2059180bc9af3eb06e8db119c7384c62c623dc47ef4d8ab1dc59e16ff2ee0df9

MD5 hash:

82bf097650dda02747c83009b3c07612

SHA1 hash:

6696b3e2db65f28ff630a3f84ab774bc1d14b269

Detections:

win_remcos_auto

Link:

https://www.unpac.me/results/90227c92-24f3-4cfe-a5f1-e08089195f0a/

Malware family:

Remcos

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/2059180bc9af/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.95

Link:

https://yomi.yoroi.company/submissions/2059180bc9af3eb06e8db119c7384c62c623dc47ef4d8ab1dc59e16ff2ee0df9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	malware_Remcos_strings Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Remcos in memory

Rule name:	Remcos Create hunting rule
Author:	kevoreilly
Description:	Remcos Payload

Rule name:	remcos_rat Create hunting rule
Author:	jeFF0Falltrades

Rule name:	REMCOS_RAT_variants Create hunting rule

Rule name:	SUSP_VBS_Wscript_Shell Create hunting rule
Author:	SECUINFRA Falcon Team
Description:	Detects the definition of 'Wscript.Shell' which is often used by Malware, FPs are possible and commmon