MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 37d426143aa4467af9d3503d7d3e9013d0581d89d9494c8150ff949bb88e48d5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 9


Intelligence 9 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 37d426143aa4467af9d3503d7d3e9013d0581d89d9494c8150ff949bb88e48d5
SHA3-384 hash: 1533f4de0d578bfd583e08ca3a480a4685413e8da29043c3f1aa7f84c1ba5f934f98d8ab626bc3e2d1637555ba2fb99f
SHA1 hash: 6a8cd5cde074fd30a6f6c44d9cffe2281c7e4c4b
MD5 hash: a91831c8daf9408d9edcfd7b2df7d0a9
humanhash: kitten-may-failed-asparagus
File name:km.vbs
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:3'409 bytes
First seen:2022-07-11 14:47:03 UTC
Last seen:Never
File type:Visual Basic Script (vbs) vbs
MIME type:text/plain
ssdeep 48:034gAKIjslvBP+xx3BG6QSdthwJQ8rSI0EAHlIlAULe60BdOlzyQ9lc/Q+:0E81+1EJQ8rSI7ulIlAW6Qg
Threatray 1'536 similar samples on MalwareBazaar
TLSH T1AA61634DB8DFA1285D336DF2DD8B449D7DA7A367A07041503A0995C7CE3A09CA382E3D
Reporter pr0xylife
Tags:RemcosRAT vbs

Intelligence

File Origin
# of uploads :
1
# of downloads :
257
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/286322/
Detection(s):
SecuriteInfo.com.Trojan.Script.Wacatac.Bml.15469.463.UNOFFICIAL
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/62cc38277d5b150059f423fb/reports/21a11eb5-37ad-4039-bbeb-df630dae0b01/overview
Result
Verdict:
UNKNOWN
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
rans.troj.adwa.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1028694
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Connects to many ports of the same IP (likely port scanning)
Contains functionality to inject code into remote processes
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Contains functionalty to change the wallpaper
Delayed program exit found
DLL side loading technique detected
Drops PE files to the startup folder
Drops VBS files to the startup folder
Injects a PE file into a foreign processes
Installs a global keyboard hook
Malicious sample detected (through community Yara rule)
Powershell drops PE file
System process connects to network (likely due to code injection or exploit)
Uses dynamic DNS services
Very long command line found
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 661185 Sample: km.vbs Startdate: 11/07/2022 Architecture: WINDOWS Score: 100 64 Malicious sample detected (through community Yara rule) 2->64 66 Antivirus detection for URL or domain 2->66 68 Yara detected Remcos RAT 2->68 70 3 other signatures 2->70 7 wscript.exe 14 2->7         started        11 wscript.exe 14 2->11         started        process3 dnsIp4 40 l-0003.l-dc-msedge.net 13.107.43.12, 443, 49756, 49763 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 7->40 42 ynza0a.ch.files.1drv.com 7->42 48 2 other IPs or domains 7->48 80 System process connects to network (likely due to code injection or exploit) 7->80 82 Wscript starts Powershell (via cmd or directly) 7->82 84 Very long command line found 7->84 13 powershell.exe 14 23 7->13         started        18 cmd.exe 1 7->18         started        44 l-0004.l-dc-msedge.net 13.107.43.13, 443, 49777 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 11->44 46 ynza0a.ch.files.1drv.com 11->46 50 2 other IPs or domains 11->50 20 powershell.exe 11->20         started        signatures5 process6 dnsIp7 52 l-0004.l-dc-msedge.net 13->52 54 l-0003.l-dc-msedge.net 13->54 60 3 other IPs or domains 13->60 34 C:\Users\user\AppData\...\AgileDotNetRT64.dll, PE32+ 13->34 dropped 36 C:\Users\user\AppData\...\AgileDotNetRT64.dll, PE32+ 13->36 dropped 86 Writes to foreign memory regions 13->86 88 DLL side loading technique detected 13->88 90 Injects a PE file into a foreign processes 13->90 92 Powershell drops PE file 13->92 22 RegAsm.exe 2 2 13->22         started        26 conhost.exe 13->26         started        94 Drops VBS files to the startup folder 18->94 96 Drops PE files to the startup folder 18->96 28 conhost.exe 18->28         started        56 l-0003.l-dc-msedge.net 20->56 58 ynaqww.ch.files.1drv.com 20->58 62 2 other IPs or domains 20->62 30 conhost.exe 20->30         started        32 RegAsm.exe 20->32         started        file8 signatures9 process10 dnsIp11 38 menz.ddns.net 185.140.53.130, 45901, 49795 DAVID_CRAIGGG Sweden 22->38 72 Contains functionalty to change the wallpaper 22->72 74 Contains functionality to steal Chrome passwords or cookies 22->74 76 Contains functionality to inject code into remote processes 22->76 78 3 other signatures 22->78 signatures12
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/37d426143aa4467af9d3503d7d3e9013d0581d89d9494c8150ff949bb88e48d5/
Threat name:
Script.Downloader.Remcos
Create hunting rule
Status:
Malicious
First seen:
2022-07-11 14:48:06 UTC
File Type:
Text (VBS)
AV detection:
6 of 26 (23.08%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=g7kcmfb2urdhv6otka6x2puqcpifqhmj3feuzakq76kjxoeojdkq._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
2a5084f190559b5e7be436f6b91952453727da22d83fd50a1f5dad8800082eaf
RemcosRAT
354a9becf30c58e1bf9bc4756fd08efc296c6f3009352b84e8073bb638533f3f
RemcosRAT
59ba6d5636e63e9dbdec9b92014e934537b2f64b5d40864a500dc53ee42714f8
RemcosRAT
5add188d307788b3a20ca00b39425d0c5a622326422a357c931eed78acc893e8
RemcosRAT
99e39ef9a5267ed9790fbef614fa3a0054025c1cb866295e9e320bc95b128280
RemcosRAT
9c9243f11dd44d1f1ac97716014be57244dca97a514e73d5f13da03392cba358
RemcosRAT
c32a878240bdd4de7b8ccb5a013e97fec1ddf804ab1e6481592971eddb5033f1
RemcosRAT
c52d747cc20d321a0185798c328468b564f9c5a213270ad07861fa7cc147fdda
RemcosRAT
+ 1'526 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:july rat
Link:
https://tria.ge/reports/220711-r6ey3saahk/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Checks computer location settings
Loads dropped DLL
Blocklisted process makes network request
Remcos
Malware Config
C2 Extraction:
menz.ddns.net:45901
Malware family:
Remcos
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/37d426143aa4/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/37d426143aa4467af9d3503d7d3e9013d0581d89d9494c8150ff949bb88e48d5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer
Create hunting rule
Author:ditekSHen
Description:detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Rule name:Remcos
Create hunting rule
Author:kevoreilly
Description:Remcos Payload
Rule name:remcos_rat
Create hunting rule
Author:jeFF0Falltrades
Rule name:REMCOS_RAT_variants
Create hunting rule
Rule name:win_remcos_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.remcos.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/286322/

Comments