MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2a5084f190559b5e7be436f6b91952453727da22d83fd50a1f5dad8800082eaf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 12


Intelligence 12 IOCs YARA 4 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2a5084f190559b5e7be436f6b91952453727da22d83fd50a1f5dad8800082eaf
SHA3-384 hash: 95dadf3314a6c7661b7c56e624a2ee540b349d7c48ca194068a1419bb3023244e90f6143475f8d7a9d42310960e6f0f7
SHA1 hash: 3c999818c33d962e3ef51672c48c213fc5551c9c
MD5 hash: 794752544167e655d37eb4525e046ffe
humanhash: avocado-uranus-spaghetti-video
File name:794752544167e655d37eb4525e046ffe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'694'208 bytes
First seen:2022-04-06 15:47:15 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 24576:sFbFkSQxX7MhisTQZJVWvZ82DCuIXqU+I3SCEuNCwQhZm7WprXDYFo:s7rQxrs/TQZJAh8y2ybLBDEo
Threatray 1'138 similar samples on MalwareBazaar
TLSH T109753B5DA3524885FED09774F8BB3BB61760857A8C8B5713A3751A3AE82F3F91E40702
File icon (PE):PE icon
dhash icon c881c09ccfa68083 (1 x RemcosRAT, 1 x Formbook)
Reporter zbetcheckin
Tags:32 exe RemcosRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
246
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Remcos
Create hunting rule
Link:
https://www.capesandbox.com/analysis/261394/
Detection(s):
Win.Trojan.EmbeddedDotNetBinary-9940868-0
Create hunting rule

Win.Trojan.EmbeddedReversedDLL-9940922-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Running batch commands
Creating a process with a hidden window
Launching a process
Sending a custom TCP request
Creating a file
Unauthorized injection to a recently created process
Setting a keyboard event handler
Creating a file in the %AppData% subdirectories
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Query of malicious DNS domain
Sending a TCP request to an infection source
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated
Link:
https://www.filescan.io/uploads/624db63940ce5db9f41ca0d1/reports/5be62fdc-e438-4a27-bebe-2a170224042b/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
REMCOS
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/15f193d7-9988-4afc-8c64-4f1d5573643d
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/971653
Signature
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Contains functionality to inject code into remote processes
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Delayed program exit found
Drops executable to a common third party application directory
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses dynamic DNS services
Yara detected Costura Assembly Loader
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 604139 Sample: iT2rWkSOTq Startdate: 06/04/2022 Architecture: WINDOWS Score: 100 51 Malicious sample detected (through community Yara rule) 2->51 53 Antivirus / Scanner detection for submitted sample 2->53 55 Yara detected Remcos RAT 2->55 57 5 other signatures 2->57 7 iT2rWkSOTq.exe 1 4 2->7         started        11 firefox.exe 2 2->11         started        13 firefox.exe 1 2->13         started        process3 file4 41 C:\Users\user\AppData\Local\firefox.exe, PE32 7->41 dropped 43 C:\Users\user\...\firefox.exe:Zone.Identifier, ASCII 7->43 dropped 45 C:\Users\user\AppData\...\iT2rWkSOTq.exe.log, ASCII 7->45 dropped 59 Contains functionality to steal Chrome passwords or cookies 7->59 61 Contains functionality to steal Firefox passwords or cookies 7->61 63 Drops executable to a common third party application directory 7->63 65 Delayed program exit found 7->65 15 iT2rWkSOTq.exe 2 2 7->15         started        19 cmd.exe 1 7->19         started        67 Antivirus detection for dropped file 11->67 69 Machine Learning detection for dropped file 11->69 71 Contains functionality to inject code into remote processes 11->71 21 cmd.exe 1 11->21         started        23 firefox.exe 11->23         started        25 cmd.exe 13->25         started        27 firefox.exe 13->27         started        signatures5 process6 dnsIp7 47 emarketinglatakva.ddns.net 45.134.173.174, 49763, 9794 CLOUDIE-AS-APCloudieLimitedHK Russian Federation 15->47 49 Installs a global keyboard hook 15->49 29 conhost.exe 19->29         started        31 timeout.exe 1 19->31         started        33 conhost.exe 21->33         started        35 timeout.exe 1 21->35         started        37 conhost.exe 25->37         started        39 timeout.exe 1 25->39         started        signatures8 process9
Detection:
remcos
Create hunting rule
Link:
https://mwdb.cert.pl/sample/2a5084f190559b5e7be436f6b91952453727da22d83fd50a1f5dad8800082eaf/
Threat name:
ByteCode-MSIL.Backdoor.Androm
Create hunting rule
Status:
Malicious
First seen:
2022-04-06 15:48:18 UTC
File Type:
PE (.Net Exe)
Extracted files:
21
AV detection:
20 of 26 (76.92%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fjiij4mqkwnv467eg33lsgksiu3spwrc3a75kcq7lwwyqaaif2xq._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
2d6b7a5513ed0cb451701bb494fb87382061195c115ede553f062b4fc0fd4f97
RemcosRAT
4ce893ef0bd7abeb769c3c3e57863700f41882befbee770733f0da86e015e7cb
RemcosRAT
625f25dedd3f7e114dc89cff907dfec350df5cbb4efa09942f2b5ed9950c1216
RemcosRAT
7b0093ab95f1f77158ba4493cde35d433e2ffde2bbe45bb4568982447046e333
RemcosRAT
8342c94ddfd4cca232e9d1cd5faed48fdce02a694b062606b938401b502a0c30
RemcosRAT
a4b821d0cadc92c344c8b60f5290a5e5520fd1fb3813b88c529c48d285b72c63
RemcosRAT
+ 1'128 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:rain persistence rat
Link:
https://tria.ge/reports/220406-s8rlbsegb4/
Behaviour
Delays execution with timeout.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Checks computer location settings
Remcos
Malware Config
C2 Extraction:
emarketinglatakva.ddns.net:9794
Unpacked files
SH256 hash:
b8fe0e94caa34b16feeb253dc014b493c21b9d43a65662006ec0b1ae64b126a7
MD5 hash:
337b1d4a4798da93f9eab69c9be1d6d0
SHA1 hash:
b778a2fc28e1590c629dcb35c8b500f32b68ef3f
Link:
https://www.unpac.me/results/1d6cc6cc-d3d1-4e4e-9b66-00cf27c5b08b/
SH256 hash:
0761714cfed74399d0851d427714d28c45e2b7529e7f8e45197383b11b804070
MD5 hash:
c1e68aa6266ad41cbf5233101a1acd3d
SHA1 hash:
ad73e444d5fcda4339bfc6b76b2003d0b2fe527f
Link:
https://www.unpac.me/results/1d6cc6cc-d3d1-4e4e-9b66-00cf27c5b08b/
SH256 hash:
e9b93c458a3209ddcb5e767ed7ad0c18138a4cb075197168e92f96c1590b91f8
MD5 hash:
ace9a800aa319f061084997893cbe25a
SHA1 hash:
5fc4933d63004cb3ca402331aa5bd7b4f088be39
Link:
https://www.unpac.me/results/1d6cc6cc-d3d1-4e4e-9b66-00cf27c5b08b/
SH256 hash:
049bf7d9d1227af60a148378a8054ad462273a4ae570bee6e77d05b6651bdb05
MD5 hash:
47ed2d0348cc0f27d25c38f46a60b4d5
SHA1 hash:
21f33d1e7f7ff9e03197ce00e52cf2675b77f404
Link:
https://www.unpac.me/results/1d6cc6cc-d3d1-4e4e-9b66-00cf27c5b08b/
SH256 hash:
2a5084f190559b5e7be436f6b91952453727da22d83fd50a1f5dad8800082eaf
MD5 hash:
794752544167e655d37eb4525e046ffe
SHA1 hash:
3c999818c33d962e3ef51672c48c213fc5551c9c
Link:
https://www.unpac.me/results/1d6cc6cc-d3d1-4e4e-9b66-00cf27c5b08b/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Typical_Malware_String_Transforms
Create hunting rule
Author:Florian Roth
Description:Detects typical strings in a reversed or otherwise modified form
Reference:Internal Research
Rule name:Typical_Malware_String_Transforms_RID3473
Create hunting rule
Author:Florian Roth
Description:Detects typical strings in a reversed or otherwise modified form
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RemcosRAT

Executable exe 2a5084f190559b5e7be436f6b91952453727da22d83fd50a1f5dad8800082eaf

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2134282/
Cape
Cape
https://www.capesandbox.com/analysis/261394/

Comments


Avatar
zbet commented on 2022-04-06 15:47:17 UTC

url : hxxp://193.142.58.55/77/vbc.exe