MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2aec68c3818dc471865d8ca5f88d783943c1efff0f66360736a09026565035b4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemcosRAT

Vendor detections: 16

Intelligence 16 IOCs YARA 27 File information Comments

SHA256 hash:	2aec68c3818dc471865d8ca5f88d783943c1efff0f66360736a09026565035b4
SHA3-384 hash:	b48b530a76d4d35b1278e93ba71b6dd0e4edf06272e3379f7757c929d86fb00ca1c66f1b00a2b9df1830cc0ca839f29c
SHA1 hash:	da2e35e0e5ee30efbb51e95afa2be326e0211b18
MD5 hash:	5780e00e9cc633815e46f76ccb662cbe
humanhash:	steak-single-skylark-oregon
File name:	RFQ00978-Abu Dhabi Hardware.exe
Download:	download sample
Signature	RemcosRAT Create hunting rule
File size:	3'642'451 bytes
First seen:	2024-06-17 08:23:17 UTC
Last seen:	2024-06-17 13:04:51 UTC
File type:	exe
MIME type:	application/x-dosexec
ssdeep	12288:vJJFaOdekWAmURqCSQSD9IGKDJ4zsRajyg7/qcuSjkRJ1wUqB5mi/kWlGhXi8d2e:vJJQQRqorIsJgZARlgEWlmXibe
Threatray	4'185 similar samples on MalwareBazaar
TLSH	T1AFF5F0823D63AD13BC958627E0D439FA04FE2E5B3CF4854FCF8CAE2492626BC4455972
TrID	44.4% (.EXE) Win64 Executable (generic) (10523/12/4) 21.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 8.7% (.ICL) Windows Icons Library (generic) (2059/9) 8.5% (.EXE) OS/2 Executable (generic) (2029/13) 8.4% (.EXE) Generic Win/DOS Executable (2002/3)
File icon (PE):
dhash icon	4c33d8d4d4d8324c (40 x AgentTesla, 23 x RedLineStealer, 15 x RemcosRAT)
Reporter	TeamDreier
Tags:	exe RemcosRAT

Intelligence

File Origin

# of uploads :

# of downloads :

353

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

dcee09f8a5fe56552dd43d2400990ab65fde4821b78c87748417f8d5b904889f.tar

Verdict:

Malicious activity

Analysis date:

2024-06-17 08:24:55 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/b335323f-c8f0-4e1d-95df-88e981c13b96

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

SecuriteInfo.com.Win64.RATX-gen.15182.25263.UNOFFICIAL

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=666ff3ad89a0563951f997d5win7simulatehigh_evasion

Tags:

Banker Encryption Execution Generic Network Stealth Remcos Dexter

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Creating a process with a hidden window

Launching a process

Searching for synchronization primitives

Connection attempt

Launching the default Windows debugger (dwwin.exe)

Creating a file

Searching for the window

Blocking the User Account Control

Adding an exclusion to Microsoft Defender

Unauthorized injection to a system process

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

overlay remcos vbnet

Link:

https://www.filescan.io/uploads/666ff2a60bf5978c0b0fff9a/reports/9a89f26d-4a6c-419b-b7c1-f8519902ac7b/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/2aec68c3818dc471865d8ca5f88d783943c1efff0f66360736a09026565035b4

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/16b2ec69-0ea2-4d8b-9c3b-cb689a64bc72

Result

Threat name:

Remcos

Detection:

malicious

Classification:

rans.troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1458222

Signature

.NET source code references suspicious native API functions

Adds a directory exclusion to Windows Defender

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to bypass UAC (CMSTPLUA)

Contains functionality to register a low level keyboard hook

Contains functionality to steal Chrome passwords or cookies

Contains functionality to steal Firefox passwords or cookies

Contains functionalty to change the wallpaper

Delayed program exit found

Detected Remcos RAT

Disables UAC (registry)

Found malware configuration

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Installs a global keyboard hook

Loading BitLocker PowerShell Module

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Remcos

Snort IDS alert for network traffic

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses regedit.exe to modify the Windows registry

Writes to foreign memory regions

Yara detected AntiVM3

Yara detected Remcos RAT

Yara detected UAC Bypass using CMSTP

Behaviour

Behavior Graph:

Download SVG

Score:

97%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/2aec68c3818dc471865d8ca5f88d783943c1efff0f66360736a09026565035b4

Detection:

remcos

Link:

https://mwdb.cert.pl/sample/2aec68c3818dc471865d8ca5f88d783943c1efff0f66360736a09026565035b4/

Threat name:

Win64.Trojan.Remcos

Status:

Malicious

First seen:

2024-06-17 00:42:06 UTC

File Type:

PE+ (.Net Exe)

Extracted files:

AV detection:

13 of 38 (34.21%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=flwgrq4brxchdbs5rss7rdlyhfb4d377b5tdmbzwucicmvsqgw2a._file

Verdict:

malicious

Label(s):

remcos

RemcosRAT

472a8fbff35cdda49a870d372fa6da50defd8480348438e245f11aad954642d1

RemcosRAT

909b4092841b4056937777a197673e86be281f43db661ee636ccd73744015768

RemcosRAT

a0c4a547b08cd4669362420f9c50b04f084e0174f13911f4e8b95cec7ba12cd8

RemcosRAT

ab4c9b244a1604655032a8f69acc4273265fa35337906e05a1dc2b274b3b13a6

RemcosRAT

fcc20fe90b357bafc8ac88a33981885be904b1ce430a4ec8b8aed5caa357df92

RemcosRAT

+ 4'175 additional samples on MalwareBazaar

Result

Malware family:

remcos

Score:

10/10

Tags:

family:remcos botnet:remotehost evasion execution rat trojan

Link:

https://tria.ge/reports/240617-kap1vawenr/

Behaviour

Runs regedit.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

System policy modification

Enumerates physical storage devices

Suspicious use of SetThreadContext

Checks whether UAC is enabled

Checks computer location settings

Windows security modification

Command and Scripting Interpreter: PowerShell

Remcos

UAC bypass

Windows security bypass

Malware Config

C2 Extraction:

23.95.60.82:4445

Unpacked files

SH256 hash:

2aec68c3818dc471865d8ca5f88d783943c1efff0f66360736a09026565035b4

MD5 hash:

5780e00e9cc633815e46f76ccb662cbe

SHA1 hash:

da2e35e0e5ee30efbb51e95afa2be326e0211b18

Link:

https://www.unpac.me/results/b4c1a13a-f4c7-465b-9af5-54c5b6dabe74/

Malware family:

Remcos

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/2aec68c3818d/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Remcos

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/2aec68c3818dc471865d8ca5f88d783943c1efff0f66360736a09026565035b4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	BLOWFISH_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for Blowfish constants

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	iexplorer_remcos Create hunting rule
Author:	iam-py-test
Description:	Detect iexplorer being taken over by Remcos

Rule name:	INDICATOR_EXE_Packed_MPress Create hunting rule
Author:	ditekSHen
Description:	Detects executables built or packed with MPress PE compressor

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many email and collaboration clients. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM Create hunting rule
Author:	ditekSHen
Description:	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)

Rule name:	maldoc_find_kernel32_base_method_1 Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

Rule name:	maldoc_getEIP_method_1 Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	meth_get_eip Create hunting rule
Author:	Willi Ballenthin

Rule name:	meth_stackstrings Create hunting rule
Author:	Willi Ballenthin

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_no_import_table Create hunting rule
Description:	Detect pe file that no import table

Rule name:	QbotStuff Create hunting rule
Author:	anonymous

Rule name:	Remcos Create hunting rule
Author:	kevoreilly
Description:	Remcos Payload

Rule name:	REMCOS_RAT_variants Create hunting rule

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

Rule name:	TeslaCryptPackedMalware Create hunting rule

Rule name:	ThreadControl__Context Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	Windows_Trojan_Remcos_b296e965 Create hunting rule
Author:	Elastic Security
Reference:	https://www.elastic.co/security-labs/exploring-the-ref2731-intrusion-set

Rule name:	win_remcos_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	Detects win.remcos.

Rule name:	win_remcos_w0 Create hunting rule
Author:	Matthew @ Embee_Research
Description:	Detects strings present in remcos rat Samples.

Rule name:	yarahub_win_remcos_rat_unpacked_aug_2023 Create hunting rule
Author:	Matthew @ Embee_Research

Rule name:	yara_template Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

exe 2aec68c3818dc471865d8ca5f88d783943c1efff0f66360736a09026565035b4

(this sample)

Delivery method

Distributed via e-mail attachment

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (GUARD_CF)	high

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample