MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 32f6ec5b5b7c806a093ab23b59252930e7a629489857dfe3659de7eec4ab01ea. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemcosRAT

Vendor detections: 12

Intelligence 12 IOCs YARA File information Comments

SHA256 hash:	32f6ec5b5b7c806a093ab23b59252930e7a629489857dfe3659de7eec4ab01ea
SHA3-384 hash:	dde55226857324ab3a95980ce6376ec6e05af3390c25a966eb65c1fb98972d5514235b5f6a36563e5fcd7b5d78b5325e
SHA1 hash:	a6c6f52394f3d87db14a63b234c78211f436123a
MD5 hash:	fa1f4d8d5928a6435435fce7453d9aaa
humanhash:	sad-three-stairway-lake
File name:	Document.exe
Download:	download sample
Signature	RemcosRAT Create hunting rule
File size:	1'025'536 bytes
First seen:	2021-10-12 17:52:17 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	138bb79e60dfba5fe7eff385ab7df367 (6 x RemcosRAT, 2 x Formbook)
ssdeep	12288:Up+vmyY9beSkj77NADGFvGq+EOvLkOUvIVPJvC+0yRK2urqoXkWsdr64lprmi:UMO3g13Wih+kOzPJp/FoVKrRpm
Threatray	802 similar samples on MalwareBazaar
TLSH	T171259E59B69A4133C2B32930DFAF83BA6676BD921D2065CB3BB41A0CCF747027935197
File icon (PE):
dhash icon	c4f0d0d4d0d4d4d4 (13 x RemcosRAT, 7 x Formbook, 1 x AveMariaRAT)
Reporter	GovCERT_CH
Tags:	exe RemcosRAT

Intelligence

File Origin

# of uploads :

# of downloads :

116

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

Document.exe

Verdict:

Malicious activity

Analysis date:

2021-10-12 17:56:31 UTC

Tags:

rat remcos keylogger

Link:

https://app.any.run/tasks/766c67ae-c437-4c98-b39a-96ba0bfd17c7

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Remcos

Link:

https://www.capesandbox.com/analysis/197018/

Detection(s):

SecuriteInfo.com.Artemis14F80D04AC41.10120.28140.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

keylogger

Link:

https://www.filescan.io/uploads/6165cb7e1c2d58ba74037d90/reports/5739802a-74a9-45f4-a701-d79b0c7f236a/overview

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Dbatloader

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/1f488849-acff-4c89-85bb-649e6bb61400

Result

Threat name:

Remcos DBatLoader

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/868926

Signature

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Contains functionality to steal Chrome passwords or cookies

Contains functionality to steal Firefox passwords or cookies

Creates a thread in another existing process (thread injection)

Delayed program exit found

Detected Remcos RAT

Found malware configuration

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Writes to foreign memory regions

Yara detected DBatLoader

Yara detected Remcos RAT

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/32f6ec5b5b7c806a093ab23b59252930e7a629489857dfe3659de7eec4ab01ea/

Threat name:

Win32.Trojan.Woreflint

Status:

Malicious

First seen:

2021-10-12 17:55:42 UTC

AV detection:

11 of 28 (39.29%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=gl3oyw23psagucj2wi5vsjjjgdt2mkkitbl57y3ftxt65rflahva._file

Verdict:

malicious

Label(s):

remcos

RemcosRAT

13e6341cacb27fdd36b2ce19395dbb02947f0c917b6fd10447f1d6381d51b7d4

RemcosRAT

23d4b811a2e3f349ac70d49dafc192bd830776257f0ea82fce704f9db6e617c2

RemcosRAT

2eb44403d1de2a792569f63907f746809e3d4e35fccf689c2e637f77df79254c

RemcosRAT

7a30ee147983ae5664dab25082f5973b2ca00d35e770b5182ed4517ffb91f5ab

RemcosRAT

7aa3e6c93ac645c2b56f93eb9fe7de45a7fb9958d491190eb6d06198a65e6ca7

RemcosRAT

7eb677c1c5c60d34da90cab2b4ea019c500b5c3db6964cc14849dbe2f9f5fa30

RemcosRAT

91e8ea3e431c0ad9faf6dfe01eb29e4834940054379deb8b657d9cbe23e91682

RemcosRAT

a737c6bf1fe3e63d6d187d114d887c6c1e722579fc9caab72ce4451564e165f6

RemcosRAT

b56242ce9875402fca36f6d831072462bcf7b0996c2a98d048455459485ade1d

RemcosRAT

+ 792 additional samples on MalwareBazaar

Result

Malware family:

remcos

Score:

10/10

Tags:

family:remcos botnet:remotehost persistence rat

Link:

https://tria.ge/reports/211012-wga12schb4/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Program crash

Adds Run key to start application

Remcos

Malware Config

C2 Extraction:

remcosw11.mywire.org:2404
remcosw22.giize.com:2404
remcosw33.kozow.com:2404
remcosw44.freeddns.org:2404
remcosw55.freeddns.org:2404
remcosw66.freeddns.org:2404
remcosw77.freeddns.org:2404