MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 30ae97a96ff5a50bbbc7af4239ed02c07a9fb2737edd2b121c255903d855c4ff. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 30ae97a96ff5a50bbbc7af4239ed02c07a9fb2737edd2b121c255903d855c4ff
SHA3-384 hash: d1091b4abeaf8c43ac966ad36a53b11fd36d5f52e9a20ba0de13b02746cfae36a34d54d48efcdef84dd7d00f7c02e6be
SHA1 hash: 305c869175eec36e73dc801cc8d9f9e17f69ef77
MD5 hash: f7b4bb2e02f6d8cba4a26a58f9041891
humanhash: mountain-may-sad-stream
File name:Document.exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:977'408 bytes
First seen:2021-03-06 18:08:51 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash eb3c6be52f0850289235bae911b61b65 (2 x RemcosRAT)
ssdeep 24576:ApIEyKFL1c+rhV9OREr9kk3JxamqkD6ST8KVC6:ApIErfJjD5T8KVC
Threatray 1 similar samples on MalwareBazaar
TLSH CE25AEA3F390AD37D5132530991B60A5ED1A7EF0391CE44A6BE47D047F3A94D3A2AC93
Reporter abuse_ch
Tags:DHL exe RemcosRAT


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: mail.helporder.online
Sending IP: 188.93.233.213
From: Dhl Customer Support <order@helporder.online>
Subject: Delivery Failed
Attachment: Attached file.iso (contains "Document.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
348
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Document.exe
Verdict:
Malicious activity
Analysis date:
2021-03-06 18:13:25 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/2b11d408-dc6f-4a6e-975c-f19151bb3813

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/122650/
Detection(s):
PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
DNS request
Sending a custom TCP request
Creating a file
Deleting a recently created file
Launching a process
Creating a file in the %AppData% subdirectories
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Setting a global event handler for the keyboard
Unauthorized injection to a system process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/630688
Signature
Allocates memory in foreign processes
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to capture and log keystrokes
Contains functionality to inject code into remote processes
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Creates a thread in another existing process (thread injection)
Delayed program exit found
Detected Remcos RAT
Found malware configuration
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Remcos
Writes to foreign memory regions
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 364316 Sample: Document.exe Startdate: 07/03/2021 Architecture: WINDOWS Score: 100 46 Multi AV Scanner detection for domain / URL 2->46 48 Found malware configuration 2->48 50 Malicious sample detected (through community Yara rule) 2->50 52 9 other signatures 2->52 6 Document.exe 1 18 2->6         started        11 Sgniupoe.exe 2->11         started        13 Sgniupoe.exe 2->13         started        process3 dnsIp4 28 cdn.discordapp.com 162.159.129.233, 443, 49722 CLOUDFLARENETUS United States 6->28 26 C:\Users\Public\Libraries\Sgniupoe.exe, PE32 6->26 dropped 54 Writes to foreign memory regions 6->54 56 Creates a thread in another existing process (thread injection) 6->56 58 Injects a PE file into a foreign processes 6->58 15 mobsync.exe 2 3 6->15         started        60 Multi AV Scanner detection for dropped file 11->60 62 Machine Learning detection for dropped file 11->62 64 Allocates memory in foreign processes 11->64 20 secinit.exe 11->20         started        22 dialer.exe 13->22         started        file5 signatures6 process7 dnsIp8 30 Bruno.camdvr.org 217.64.151.237, 2404 OBE-EUROPEObenetworkEuropeSE Sweden 15->30 32 Bruno2.camdvr.org 15->32 34 Bruno1.camdvr.org 15->34 24 C:\Users\user\AppData\Roaming\...\logs.dat, ASCII 15->24 dropped 36 Contains functionality to steal Chrome passwords or cookies 15->36 38 Contains functionality to capture and log keystrokes 15->38 40 Contains functionality to inject code into remote processes 15->40 42 Contains functionality to steal Firefox passwords or cookies 20->42 44 Delayed program exit found 20->44 file9 signatures10
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/30ae97a96ff5a50bbbc7af4239ed02c07a9fb2737edd2b121c255903d855c4ff/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2021-03-06 14:55:17 UTC
AV detection:
13 of 28 (46.43%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gcxjpklp6wsqxo6hv5bdt3icyb5j7mttp3osweq4evmqhwcvyt7q._file
Verdict:
unknown
Similar samples:
11574e6b8024699ebcbd840e3dbf4adf4b93f0c5a3c120dca1bdbb29362e78af
RemcosRAT
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos persistence rat
Link:
https://tria.ge/reports/210306-75s8n1bkgn/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Program crash
Adds Run key to start application
Remcos
Malware Config
C2 Extraction:
Bruno.camdvr.org:2404
Bruno1.camdvr.org:2404
Bruno2.camdvr.org:2404
Unpacked files
SH256 hash:
6cf97407564758a89313c781f003b69f85db94e608e0d1814da724c4e3917530
MD5 hash:
86d444f389003fb10ff0a4bec5e0f46f
SHA1 hash:
ecdb825b2aec46da313937e54e384a61ed1394cb
Link:
https://www.unpac.me/results/fb397a1f-877f-42aa-9be3-50ad630daf2b/
SH256 hash:
30ae97a96ff5a50bbbc7af4239ed02c07a9fb2737edd2b121c255903d855c4ff
MD5 hash:
f7b4bb2e02f6d8cba4a26a58f9041891
SHA1 hash:
305c869175eec36e73dc801cc8d9f9e17f69ef77
Link:
https://www.unpac.me/results/fb397a1f-877f-42aa-9be3-50ad630daf2b/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/30ae97a96ff5a50bbbc7af4239ed02c07a9fb2737edd2b121c255903d855c4ff

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

iso 1b82b497c5a133e9a9bcbb1234fb288ce9a329eec3cf82a9ee2178d0f8a7c9e3

RemcosRAT

Executable exe 30ae97a96ff5a50bbbc7af4239ed02c07a9fb2737edd2b121c255903d855c4ff

(this sample)

  
Dropped by
MD5 8432b1b33d0aa4c57cb92aef416163e0
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/122650/
  
Dropped by
SHA256 1b82b497c5a133e9a9bcbb1234fb288ce9a329eec3cf82a9ee2178d0f8a7c9e3

Comments