MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 273f0b59464f9a1ece08ee3bfc848bb6fed6eeb0fef90df2fecbbeda9ee61fcc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemcosRAT

Vendor detections: 7

Intelligence 7 IOCs YARA 2 File information Comments

SHA256 hash:	273f0b59464f9a1ece08ee3bfc848bb6fed6eeb0fef90df2fecbbeda9ee61fcc
SHA3-384 hash:	9bc7bc83d614bfdf28d96c3a56abb71f6f3b375edf41add911a2c647120bd8cb5148ba71ad9c5e09271a188079bac770
SHA1 hash:	d40ad627dfeafde6f4924485fef7727937a7ba9e
MD5 hash:	45514763dea353212ffd2fdd2827471f
humanhash:	sink-green-missouri-wyoming
File name:	RFQ 80380 N 2023 JANUARY 04606.gz
Download:	download sample
Signature	RemcosRAT Create hunting rule
File size:	802'407 bytes
First seen:	2023-01-23 10:18:19 UTC
Last seen:	2023-01-23 10:30:39 UTC
File type:	gz
MIME type:	application/gzip
ssdeep	24576:nKEm2zo5RHxNDHpek5PkokBRpgAnK3oKja8wNhbdZK:dm2zo5RHbDHpek5PkdB8AnK3oB8w/HK
TLSH	T1EA0533BE2F26BF89DC58DD09401C089F527FBC5C56FB1EC51AE2E9DE5237AE02185422
Reporter	cocaman
Tags:	gz RFQ

cocaman

Malicious email (T1566.001)
From: ""Caline Senriangi. S (Anggi)" <cali@oasinaturale.com>" (likely spoofed)
Received: "from psnarzkm.oasinaturale.com (psnarzkm.oasinaturale.com [92.52.217.240]) "
Date: "Sun, 22 Jan 2023 21:27:58 -0800"
Subject: "NLT 90470 ORDER CONFIRMATION REQUEST 2023"
Attachment: "RFQ 80380 N 2023 JANUARY 04606.gz"

Intelligence

File Origin

# of uploads :

# of downloads :

100

Origin country :

n/a

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	RFQ 80380 N 2023 JANUARY 04606.exe
File size:	884'736 bytes
SHA256 hash:	490f282d4fd00248b4f2c3ee4b5586d7af9b8cef6702f035abfee65482289d99
MD5 hash:	909588e87fae1849fbe46e446776ed1a
MIME type:	application/x-dosexec
Signature	RemcosRAT

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Win32.PWSX-gen.9937.25981.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/63ce5f192b351a3d0ea7df64/reports/0768996b-85a8-4776-94b7-a1302e75261b/overview

Result

Verdict:

MALICIOUS

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/273f0b59464f9a1ece08ee3bfc848bb6fed6eeb0fef90df2fecbbeda9ee61fcc/

Threat name:

Win32.Trojan.Casdet

Status:

Malicious

First seen:

2023-01-23 08:13:36 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

19 of 39 (48.72%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=e47qwwkgj6nb5tqi5y57zbelw37nn3vq734q34x6zo7nvhxgd7ga._file

Result

Malware family:

remcos

Score:

10/10

Tags:

family:remcos botnet:remotehost persistence rat

Link:

https://tria.ge/reports/230123-mv59nsch79/

Behaviour

Creates scheduled task(s)

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Suspicious use of SetThreadContext

Adds Run key to start application

Checks computer location settings

Loads dropped DLL

Executes dropped EXE

Remcos

Malware Config

C2 Extraction:

45.139.105.174:6320

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/273f0b59464f9a1ece08ee3bfc848bb6fed6eeb0fef90df2fecbbeda9ee61fcc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.