MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 38602e2e2f729e174440339fd1551e133ae03d93e16bbcef8f0b9c8aa1da9b1c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemoteManipulator


Vendor detections: 10


Intelligence 10 IOCs 1 YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 38602e2e2f729e174440339fd1551e133ae03d93e16bbcef8f0b9c8aa1da9b1c
SHA3-384 hash: 65a8a0ca671b82a0c0c3b4958f54a4cd693ce083307c122a935ee0e405b6c23cec425d66fe17896eab4d4620dc639303
SHA1 hash: 5bea1ae34cbee1c09d10c7f4f7001daeb18d607c
MD5 hash: 661c88e07591a8919e5004cc936ea3ff
humanhash: mirror-carolina-pasta-jupiter
File name:661c88e07591a8919e5004cc936ea3ff.exe
Download: download sample
Signature RemoteManipulator
Create hunting rule
File size:11'404'528 bytes
First seen:2021-05-11 08:10:40 UTC
Last seen:2021-05-11 09:09:41 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 19b321cb7a9ce31c90397152f38b67ea (29 x RemoteManipulator)
ssdeep 196608:zp9fLX9eVylQS1OnBXUc1Q4NUBD2LQVWuuFYcKXJgjaZdeCY:zH9ZlQS1Odx2WQ82cKej09Y
Threatray 27 similar samples on MalwareBazaar
TLSH 0AB63352E7E64829D4BB4BFE0ABD5B14177ABC995A1397CD0364F12C4C3338198A63CB
Reporter abuse_ch
Tags:exe RemoteManipulator


Avatar
abuse_ch
RemoteManipulator C2:
83.220.53.151:5655

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
83.220.53.151:5655 https://threatfox.abuse.ch/ioc/35268/

Intelligence

File Origin
# of uploads :
3
# of downloads :
129
Origin country :
n/a
Vendor Threat Intelligence
Detection:
RemoteUtilitiesRAT
Create hunting rule
Link:
https://www.capesandbox.com/analysis/154947/
Detection(s):
PUA.Win.Packer.Upolyx-12
Create hunting rule

PUA.Win.Packer.Upx-4
Create hunting rule

PUA.Win.Packer.Exe-6
Create hunting rule

Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Creating a window
Creating a file in the %AppData% subdirectories
Sending a UDP request
Creating a process from a recently created file
Launching a service
DNS request
Sending a custom TCP request
Creating a file in the Windows subdirectories
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
RMSRemoteAdmin
Create hunting rule
Detection:
suspicious
Classification:
evad
Score:
30 / 100
Link:
https://www.joesandbox.com/analysis/778376
Signature
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/38602e2e2f729e174440339fd1551e133ae03d93e16bbcef8f0b9c8aa1da9b1c/
Threat name:
Win32.Trojan.RemoteUtilities
Create hunting rule
Status:
Malicious
First seen:
2021-05-10 00:55:05 UTC
AV detection:
5 of 29 (17.24%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hbqc4lrpokpborcagop5cvi6cm5oapmt4fv3z34pbooivio2tmoa._file
Verdict:
malicious
Similar samples:
118dd258630c48b0beacd8b4c04c9c9cd3b9f698b660b6a904b1dfc033e00cd1
RemoteManipulator
5312214b15330113f6eab71565e1e3c7d1ee3b59daa6703c271aaf3b192e6809
RemoteManipulator
6c8a5f43e07034d0545c60c137f96c6ab8da44cfd59a8654896c8f6c497aefad
RemoteManipulator
6dda990d8073fee71cedeabd622f6d7a9be6fb2e696bda71e7b709f1c08f5e36
RemoteManipulator
7cebce024d5351e0179898fffce2628756bdcd33f9ce3833f922f1265b6e5f73
RemoteManipulator
8f4d63fea00eca6d91147de6a10b7aae6069f164ef00d5986eff571249552dae
RemoteManipulator
8fba783fb93013344dd2182721a3b1a3fbc96b7b8c49ad4b364c63a0f2b11496
RemoteManipulator
b5961f407c0afef04c9406ba17cbae3fe4cc575b47e50081abbda0d96f9c0f18
RemoteManipulator
ed20ff85f5df587140e0780e16a5eb28df94e1b6330c8256de39d94b5a772e83
RemoteManipulator
ee0400adcec67d05e4b6825df53ff7e5fb5d86680a65264976940239c322d9fb
RemoteManipulator
+ 17 additional samples on MalwareBazaar
Result
Malware family:
rms
Create hunting rule
Score:
  10/10
Tags:
family:rms rat trojan upx
Link:
https://tria.ge/reports/210511-rmd1l5y1vj/
Behaviour
Modifies data under HKEY_USERS
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in System32 directory
Checks computer location settings
Loads dropped DLL
Executes dropped EXE
RMS
Suspicious use of NtCreateUserProcessOtherParentProcess
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Backdoor
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/38602e2e2f729e174440339fd1551e133ae03d93e16bbcef8f0b9c8aa1da9b1c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:suspicious_packer_section
Create hunting rule
Author:@j0sm1
Description:The packer/protector section names/keywords
Reference:http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/154947/

Comments