MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2b08ba942fe3db3fb1937ca40e1f392ed7d98513b70fd73c2da9723ac8c971ac. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemcosRAT

Vendor detections: 7

Intelligence 7 IOCs YARA 5 File information Comments

SHA256 hash:	2b08ba942fe3db3fb1937ca40e1f392ed7d98513b70fd73c2da9723ac8c971ac
SHA3-384 hash:	dcd956452b8af94bbd15f03b6d06e4126c031d75ea7bf40f81aff87ccc2620908b13711685c4bbdcb0a7b8c88b59d182
SHA1 hash:	5cbc3d2fe90cbd331b7358cea28ea8cc5ad28b3b
MD5 hash:	8046dae95394e8f8d0f70638678aa4bd
humanhash:	charlie-yankee-snake-bacon
File name:	PO-LIST.zip
Download:	download sample
Signature	RemcosRAT Create hunting rule
File size:	1'569'408 bytes
First seen:	2024-09-19 12:37:17 UTC
Last seen:	Never
File type:	zip
MIME type:	application/x-rar
ssdeep	24576:H3Gs2GVrF3nXbPFILCRdR5s/rp9m8U7ixXt1JiDGFoAdKf4hTUQZ8iQmtq+5fV7:H2JGf3XxILCRwQ8U7gkdNf+NZXV75h
TLSH	T110753304C28E294B52DD2090B5DAAA4F0F3D0A4DFF775720E669E39199CA7B4773C60E
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	kddx0178318
Tags:	c2 RemcosRAT zip

kddx0178318

https://www.hercvlesconcrete.com/PO-LIST.zip >PO-LIST.exe >
45.138.16.248:8081
178.237.33.50:80

Intelligence

File Origin

# of uploads :

# of downloads :

111

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	PO-LIST.exe
File size:	2'097'152 bytes
SHA256 hash:	0482038dee8cdc3992533d6d3bfd36123a0efc02809b9c1cb87febef83a3517a
MD5 hash:	e21b8ab721253a904d148587bb256be4
MIME type:	application/x-dosexec
Signature	RemcosRAT

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.27572.Rar5Heur.UNOFFICIAL

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=66ec1b304ec6bdebe5304759

Tags:

Stealth Trojan Autoit

Gathering data

Verdict:

Suspicious

Labled as:

Mal/DrodRar

Link:

https://www.hybrid-analysis.com/sample/2b08ba942fe3db3fb1937ca40e1f392ed7d98513b70fd73c2da9723ac8c971ac

Result

Verdict:

MALICIOUS

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2b08ba942fe3db3fb1937ca40e1f392ed7d98513b70fd73c2da9723ac8c971ac/

Threat name:

Win32.Backdoor.Remcos

Status:

Malicious

First seen:

2024-09-18 13:59:40 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

17 of 24 (70.83%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=fmelvfbp4pnt7mmtpssa4hzzf3l5tbitw4h5opbnvfzdvsgjogwa._file

Result

Malware family:

remcos

Score:

10/10

Tags:

family:remcos botnet:spirit discovery rat

Link:

https://tria.ge/reports/240919-q2z8sa1era/

Behaviour

Suspicious behavior: MapViewOfSection

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

AutoIT Executable

Suspicious use of SetThreadContext

Drops startup file

Executes dropped EXE

Loads dropped DLL

Remcos

Malware Config

C2 Extraction:

nzobaku.ddns.net:8081

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AutoIT_Compiled Create hunting rule
Author:	@bartblaze
Description:	Identifies compiled AutoIT script (as EXE). This rule by itself does NOT necessarily mean the detected file is malicious.