MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 37a9969f1c0394c3899ffcd2fcebf9c9393bc712da4c80d4cdb2b19adec5334f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 11


Intelligence 11 IOCs YARA 3 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 37a9969f1c0394c3899ffcd2fcebf9c9393bc712da4c80d4cdb2b19adec5334f
SHA3-384 hash: c29d9d3c0dcc308a27f134d8a0e6a82f75350845edd7998b03f13c9c37cfcc7a807940cd092d3d5b20c02a31622e84b1
SHA1 hash: 15dac9ff0a8a37c908b4ce88a2082bef11162d0b
MD5 hash: 7df437287fb8e7644b93814faa7364bb
humanhash: three-carbon-beryllium-diet
File name:7df437287fb8e7644b93814faa7364bb
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:437'248 bytes
First seen:2021-07-13 04:58:38 UTC
Last seen:2021-07-13 05:48:38 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:6jY7B8niNRVZqD0Qetm74THCGec/yzDO//0hw:6shrXm7sHeDC
Threatray 1'866 similar samples on MalwareBazaar
TLSH T11C942330FA4AD40FCCAD0B7652E8E8E1C179A1251D26EA1F767D442883D2B38E7517D7
Reporter zbetcheckin
Tags:32 exe RemcosRAT

Intelligence

File Origin
# of uploads :
2
# of downloads :
129
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
7df437287fb8e7644b93814faa7364bb
Verdict:
Malicious activity
Analysis date:
2021-07-13 04:59:28 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/6553c52d-97b2-4b46-8ce5-46bc18f1f85f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Remcos
Create hunting rule
Link:
https://www.capesandbox.com/analysis/171218/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.46619297.27552.31773.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b76cd5c8-e14a-4068-b95d-1a7ff8abda7e
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/815265
Signature
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 447676 Sample: PhqTIOhCmZ Startdate: 13/07/2021 Architecture: WINDOWS Score: 52 32 Multi AV Scanner detection for submitted file 2->32 7 PhqTIOhCmZ.exe 3 2->7         started        process3 process4 9 powershell.exe 7->9         started        12 powershell.exe 5 7->12         started        14 powershell.exe 5 7->14         started        16 22 other processes 7->16 signatures5 34 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 9->34 18 conhost.exe 9->18         started        20 conhost.exe 12->20         started        22 conhost.exe 14->22         started        24 conhost.exe 16->24         started        26 conhost.exe 16->26         started        28 conhost.exe 16->28         started        30 19 other processes 16->30 process6
Detection:
remcos
Create hunting rule
Link:
https://mwdb.cert.pl/sample/37a9969f1c0394c3899ffcd2fcebf9c9393bc712da4c80d4cdb2b19adec5334f/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-07-12 22:55:18 UTC
AV detection:
7 of 28 (25.00%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
0b21cb47c8a19319e7a3ea04878670d09a51e7b377fdcb9e0009f1cb0700348b
RemcosRAT
34540a51780e487ff9426db2ea9e2ed985e6c46130439de2e434b4a804446566
RemcosRAT
3a222c1cf4a6781bec3be666c9093c809f80be4f1d4760805aba6f6827e1d278
RemcosRAT
4c11b7fb217b3675e60d659ce0a2c3eee1bdbd3e3ddba1ad6d762878f62534d1
RemcosRAT
657cf5b353228351f20b758886ed20ea09b2f2ad0740ab826e8ffdf2df8ab947
RemcosRAT
6654c75acd136f37aad63d828eea396361326bb422a91563998ff0302de2bd20
RemcosRAT
b09cafd97a01e079b28616295179f5ee5269b5f24b8bb25e4fa15625729077f7
RemcosRAT
ce4962d3126223b4bd68704159cbdc7479fb2df4263fb9f3d57492e770b74a94
RemcosRAT
d45d40989488d330e82db097aa2d857ea5d620526171cd8fb145ef62cb4ea701
RemcosRAT
f19b2e31a0bc55cb5d4ab540605cfeffca6dd241cbe4e96e065d403a7273534a
RemcosRAT
+ 1'856 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:host rat
Link:
https://tria.ge/reports/210713-jz6zyxc5z2/
Behaviour
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Remcos
Malware Config
C2 Extraction:
dpqw-avira.bot.nu:2404
Unpacked files
SH256 hash:
811b7646d5fc46e9f20d83fad8cd32b72034bfeb865eba5fd79b626f8d44ceb5
MD5 hash:
e5a5e12ffda00ac19400011cdc7c247e
SHA1 hash:
84b1b1c2b94bf69beae789ccf2ea853ab6dac254
Link:
https://www.unpac.me/results/8715aaad-ed42-4d6e-84bc-d7ac5ca0a800/
SH256 hash:
7ce17a8ef36d4f4c52ceaddab9f0da0ef353eb58c555abd7d4a2f3927332de20
MD5 hash:
e04d6af2ea13ba6f2cdc4fe6d1bf8e7b
SHA1 hash:
653ab5562a8bceecf3798f39f9710288b4b2a5ea
Link:
https://www.unpac.me/results/8715aaad-ed42-4d6e-84bc-d7ac5ca0a800/
SH256 hash:
ed3a96630761ee25131c40b747f50fc55aa85d5e8f631f71bbfc901dd96bac13
MD5 hash:
04694be6bf4a97114fda8dec4f9b8f42
SHA1 hash:
91f4b470a65d756c32ce1967b8e5300ba70383c5
Detections:
win_remcos_g0
Create hunting rule
win_remcos_auto
Create hunting rule
Link:
https://www.unpac.me/results/8715aaad-ed42-4d6e-84bc-d7ac5ca0a800/
Parent samples :
ed62eff9a728c54286e8a6ed5b4bae53667496f354118a75a15a050e15a9df30
ed3a96630761ee25131c40b747f50fc55aa85d5e8f631f71bbfc901dd96bac13
37a9969f1c0394c3899ffcd2fcebf9c9393bc712da4c80d4cdb2b19adec5334f
SH256 hash:
37a9969f1c0394c3899ffcd2fcebf9c9393bc712da4c80d4cdb2b19adec5334f
MD5 hash:
7df437287fb8e7644b93814faa7364bb
SHA1 hash:
15dac9ff0a8a37c908b4ce88a2082bef11162d0b
Link:
https://www.unpac.me/results/8715aaad-ed42-4d6e-84bc-d7ac5ca0a800/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/37a9969f1c0394c3899ffcd2fcebf9c9393bc712da4c80d4cdb2b19adec5334f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:buerloader_halo_generated
Create hunting rule
Author:Halogen Generated Rule, Corsin Camichel
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RemcosRAT

Executable exe 37a9969f1c0394c3899ffcd2fcebf9c9393bc712da4c80d4cdb2b19adec5334f

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/171218/
  
URLhaus
https://urlhaus.abuse.ch/url/1440607/
  
URLhaus
https://urlhaus.abuse.ch/url/1398046/

Comments


Avatar
zbet commented on 2021-07-13 04:58:39 UTC

url : hxxp://kqz.ugo.si/tasksmgr.exe