MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 32cc036ec39f8778c6920c98f1e8c5adb49419c51f8e828df32f9d6ff98c483b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 12


Intelligence 12 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 32cc036ec39f8778c6920c98f1e8c5adb49419c51f8e828df32f9d6ff98c483b
SHA3-384 hash: 1917f8c7a95e5e8f2c54c60cad06e497cddc3e9cca58766acbe2dfa8d1537c477a4b4e11b9fffe2b666ebc0a39d1dc3c
SHA1 hash: 9c422bf3a0894fcd564218df80bba3a64fe8876e
MD5 hash: 79d3383119947e851d1f558a8b7a30a7
humanhash: december-pluto-illinois-cola
File name:SecuriteInfo.com.Win32.RATX-gen.31605
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'289'728 bytes
First seen:2022-09-26 05:46:57 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 24576:UYCHRuAAlZGLfERudiblcRmia/YS6HZbNVmG++:UNxuAAlZGLfEwMKRmi4YSEqG
Threatray 933 similar samples on MalwareBazaar
TLSH T1D05501230BEB9B4BD011767895D1D3F9A7A9CD00E867C2E76BCA6C1FF08A4259771321
TrID 72.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.4% (.EXE) Win64 Executable (generic) (10523/12/4)
6.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.4% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter SecuriteInfoCom
Tags:exe RemcosRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
259
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/313412/
Detection(s):
SecuriteInfo.com.Win32.RATX-gen.31605.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Launching a process
Creating a file
Sending a custom TCP request
DNS request
Sending an HTTP GET request
Unauthorized injection to a system process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/63313d16da5bfff0bb766426/reports/c5341952-0092-41cd-b679-bf65f4f8e46e/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
REMCOS
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/fad77738-47ee-4255-ae03-286a5efdc4db
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/1077166
Signature
.NET source code contains potential unpacker
C2 URLs / IPs found in malware configuration
Installs a global keyboard hook
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected AntiVM3
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/32cc036ec39f8778c6920c98f1e8c5adb49419c51f8e828df32f9d6ff98c483b/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-09-26 05:47:11 UTC
File Type:
PE (.Net Exe)
Extracted files:
13
AV detection:
24 of 40 (60.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=glgag3wdt6dxrrusbsmpd2gfvw2jigofd6hifdptf6ow76mmja5q._file
Verdict:
malicious
Similar samples:
3b8dcf7047a2d9440e4809359bec667476f816e5ca27e3fed3c072c8131b77be
RemcosRAT
835895ee89c69f1fd6b85b8b755d4ec1ae178bfa90a2a056b684b7dd43131f05
RemcosRAT
9bef97a88743c2e93fbeeedfdc30a51f8f88a2b7b958f562ef9b4aa9c07bd756
RemcosRAT
9fd17bb86920c52db8ddcbd18efb3725f5570db182676fa678756cc3d3e11c9d
RemcosRAT
a8b84e503c11cce5530fb019cd43a0306656dd22e78eac4279a332b00430ed8d
RemcosRAT
aa42f20183026e8912e487dc655d4459e8e37e3743cdc7753dc60fa712d8117f
RemcosRAT
b61c01986b22368ac8981d54811a6c7c1355b6e0f40c51b5ceba65229989d7a3
RemcosRAT
ba162d7df1cd1beb851a29a69054491959d8ee6ad27f18b3e9dc57a3f6df1122
RemcosRAT
e7104f2261f0eac61f2f5c3e316f32475d10b1e4a0df6323f400d1446807d4a0
RemcosRAT
e8911ed914364aaa1dbffcfe55c53e2932e9f38ea490523a8bcaf8e13633187a
RemcosRAT
+ 923 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:remotehost ewa cartoon rat
Link:
https://tria.ge/reports/220926-ggvywsagfl/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Uses the VBS compiler for execution
Remcos
Malware Config
C2 Extraction:
164.68.105.38:1960
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/bda36f73-0b96-4729-8e89-b5b731b63a11
Unpacked files
SH256 hash:
4c565f789e34d0cf9d6cb7361ad45a5a2ffa01f664dcd49a1da2e25be36f5682
MD5 hash:
ba07eb52ad32844e2a34c9a30e92d4f9
SHA1 hash:
e87c52e3fd76d2120f671c8f3163255fbeec564f
Detections:
win_remcos_auto
Create hunting rule
Link:
https://www.unpac.me/results/31b93e03-7198-44b7-b4cf-669da0ce45c4/
Parent samples :
32cc036ec39f8778c6920c98f1e8c5adb49419c51f8e828df32f9d6ff98c483b
15194ffa05cc42d107aa2dd6e87f93a2377182044d9f525df362f12ace6fd72f
535250e39240c6587646ad1876e2ed517e86f90d18099dab5e667cae2ef507e2
70d6e951bd55244ca98fe522042be5209783c38dbe261d9f4c577da2cc6939cd
d7af53e976dcd39bc14d8e6c594c32bd33b7567b24148c924b4314b5c6327907
56bc72f3b4276309ba8b16991e1534895eb11195fe2fdb4ae9d9afb8aafe43db
8e143cf495b03daa40f3e69a8df37ef5298a75ebc25620557065975a5cdd35c1
SH256 hash:
2470b39032f6182252039c88199016566b0de30c6aa02163a143427afedd12af
MD5 hash:
c3a1924684ca30ed22234ce1d9111dfc
SHA1 hash:
7347706241422758c06440fd6044ae4e042b456b
Link:
https://www.unpac.me/results/31b93e03-7198-44b7-b4cf-669da0ce45c4/
SH256 hash:
769be523b6b04f6fbfd306659603cd65a48540861b2f6aef4eaa56ef9324d6b2
MD5 hash:
8735a4468cf6eac93b257c03c0642b6f
SHA1 hash:
595f15c42b4915f732d911d60661f34bae7b92ef
Link:
https://www.unpac.me/results/31b93e03-7198-44b7-b4cf-669da0ce45c4/
SH256 hash:
46c36f371c5512dd134fd1debf868b2600b8dad9949320c439bce1859d43ad29
MD5 hash:
bdd498bab153bc980b431b8d2605593a
SHA1 hash:
25ee5e3777fe9cdd709f48d77ba20a5521829109
Link:
https://www.unpac.me/results/31b93e03-7198-44b7-b4cf-669da0ce45c4/
SH256 hash:
e20ec8f3c957bcb6a194ef688bae8af2015cfffb20e7baf8b2114d7b70ade4ee
MD5 hash:
35cb29046968faca7f3f3b4463449b6c
SHA1 hash:
088c8c30ec1bece0a4b5bbfe3982b073f8b95598
Link:
https://www.unpac.me/results/31b93e03-7198-44b7-b4cf-669da0ce45c4/
SH256 hash:
32cc036ec39f8778c6920c98f1e8c5adb49419c51f8e828df32f9d6ff98c483b
MD5 hash:
79d3383119947e851d1f558a8b7a30a7
SHA1 hash:
9c422bf3a0894fcd564218df80bba3a64fe8876e
Link:
https://www.unpac.me/results/31b93e03-7198-44b7-b4cf-669da0ce45c4/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/32cc036ec39f/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/32cc036ec39f8778c6920c98f1e8c5adb49419c51f8e828df32f9d6ff98c483b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/313412/

Comments