🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3c911df5b86df9712bf5f14ff49c3beadb62cbde886609139c437bf0a919fc49. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 13


Intelligence 13 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3c911df5b86df9712bf5f14ff49c3beadb62cbde886609139c437bf0a919fc49
SHA3-384 hash: 6f3bd6539f94381905836c9cd04be32c1278a1197c950a23e5a0bc24ab3e8cf8b629543360b0ed3d40b50188d49bf222
SHA1 hash: 254d8d808f678540ff8a55836e92a444dd2d44e3
MD5 hash: 35e11c13023ab1ac61074ad93aabaa91
humanhash: blue-tango-hamper-fruit
File name:3c911df5b86df9712bf5f14ff49c3beadb62cbde886609139c437bf0a919fc49
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:2'101'760 bytes
First seen:2024-09-06 14:39:23 UTC
Last seen:2024-09-06 15:40:44 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 7b5d177b063b76d3393869008338136a (1 x RemcosRAT)
ssdeep 49152:Spa15dx9PeTsoRC2lJ9+LN8GHutn1c/GVzp1wTHyQhBCMsvEq3eBiDw0u8uWB9TE:21wTHF5svPOYDw0RrJM
Threatray 4'440 similar samples on MalwareBazaar
TLSH T14AA5AE20F585C0F9D99A00BC681DB26A926CA3F93B1754CBB2581D2E6D327D3B73C752
TrID 40.3% (.EXE) Win64 Executable (generic) (10523/12/4)
19.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
17.2% (.EXE) Win32 Executable (generic) (4504/4/1)
7.7% (.EXE) OS/2 Executable (generic) (2029/13)
7.6% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
Reporter JAMESWT_WT
Tags:dll privmerkt-com remcos RemcosRAT

Intelligence

File Origin
# of uploads :
2
# of downloads :
449
Origin country :
IT IT
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Inject5.7247.20869.27817.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=66db1447f3d7ccf99f902e8c
Tags:
Discovery Execution Infostealer Network Static Stealth Remcos
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Launching a process
Сreating synchronization primitives
DNS request
Connection attempt
Sending a custom TCP request
Sending an HTTP GET request
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a file
Running batch commands
Unauthorized injection to a system process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
crypto hacktool microsoft_visual_cc packed remcos
Link:
https://www.filescan.io/uploads/66db1450362fc3477390c7ec/reports/d2b763db-816e-4dd7-b461-0d2f68e01684/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/3c911df5b86df9712bf5f14ff49c3beadb62cbde886609139c437bf0a919fc49
Malware family:
REMCOS
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/350dee1b-398d-4370-b922-1438c8a39660
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
rans.troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1505692
Signature
AI detected suspicious sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to bypass UAC (CMSTPLUA)
Contains functionality to register a low level keyboard hook
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Contains functionalty to change the wallpaper
Creates autostart registry keys with suspicious names
Creates multiple autostart registry keys
Delayed program exit found
Detected Remcos RAT
Drops large PE files
Drops PE files to the document folder of the user
Found malware configuration
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Remcos
Sigma detected: Rundll32 Execution Without CommandLine Parameters
Suricata IDS alerts for network traffic
System process connects to network (likely due to code injection or exploit)
Yara detected Remcos RAT
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1505692 Sample: V9HUU0LCin.dll Startdate: 06/09/2024 Architecture: WINDOWS Score: 100 61 privmerkt.com 2->61 63 nwemarkets.com 2->63 65 geoplugin.net 2->65 83 Suricata IDS alerts for network traffic 2->83 85 Found malware configuration 2->85 87 Malicious sample detected (through community Yara rule) 2->87 89 8 other signatures 2->89 10 loaddll32.exe 1 2->10         started        12 rundll32.exe 2->12         started        14 rundll32.exe 2->14         started        signatures3 process4 process5 16 rundll32.exe 1 10->16         started        20 cmd.exe 1 10->20         started        22 rundll32.exe 10->22         started        24 2 other processes 10->24 file6 53 C:\Users\user\Documents\FirefoxData.dll, PE32 16->53 dropped 71 Contains functionality to bypass UAC (CMSTPLUA) 16->71 73 Drops PE files to the document folder of the user 16->73 75 Contains functionalty to change the wallpaper 16->75 79 4 other signatures 16->79 26 rundll32.exe 3 15 16->26         started        31 cmd.exe 1 16->31         started        33 rundll32.exe 20->33         started        77 Injects a PE file into a foreign processes 22->77 35 rundll32.exe 22->35         started        37 rundll32.exe 24->37         started        signatures7 process8 dnsIp9 67 privmerkt.com 172.111.244.7, 49701, 49704, 6042 M247GB United States 26->67 69 geoplugin.net 178.237.33.50, 49705, 80 ATOM86-ASATOM86NL Netherlands 26->69 57 C:\Users\user\AppData\Local\...\res_out.exe, PE32 26->57 dropped 105 System process connects to network (likely due to code injection or exploit) 26->105 107 Detected Remcos RAT 26->107 39 res_out.exe 2 2 26->39         started        43 reg.exe 1 1 31->43         started        45 conhost.exe 31->45         started        109 Injects a PE file into a foreign processes 33->109 47 rundll32.exe 33->47         started        file10 signatures11 process12 file13 55 C:\Users\user\Pictures\...\ClipperNss.exe, PE32 39->55 dropped 91 Antivirus detection for dropped file 39->91 93 Multi AV Scanner detection for dropped file 39->93 95 Contains functionality to bypass UAC (CMSTPLUA) 39->95 103 6 other signatures 39->103 49 res_out.exe 3 13 39->49         started        97 Creates autostart registry keys with suspicious names 43->97 99 Creates multiple autostart registry keys 43->99 101 Detected Remcos RAT 47->101 signatures14 process15 dnsIp16 59 nwemarkets.com 172.94.9.207 VOXILITYGB United States 49->59 81 Detected Remcos RAT 49->81 signatures17
Score:
14%
Verdict:
Benign
File Type:
PE
Link:
https://malprob.io/report/3c911df5b86df9712bf5f14ff49c3beadb62cbde886609139c437bf0a919fc49
Detection:
remcos
Create hunting rule
Link:
https://mwdb.cert.pl/sample/3c911df5b86df9712bf5f14ff49c3beadb62cbde886609139c437bf0a919fc49/
Threat name:
Win32.Backdoor.Remcos
Create hunting rule
Status:
Malicious
First seen:
2024-08-13 17:43:28 UTC
File Type:
PE (Dll)
Extracted files:
8
AV detection:
22 of 38 (57.89%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hsir35nynx4xck7v6fh7jhb35lnwfs66rbtase44in57bkiz7req._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
5b1aa2286d1b856ce45fc1bf075f36454aaac664460afb91185c4cc451291b62
RemcosRAT
6d45e15f47f3192d5fe0eacae6bb19a6f0f6976410167377b13b6c109a0b9b9b
RemcosRAT
75f846b15fa1b548a0143f35584b25875a03c03a783e9310c8573f3b76957688
RemcosRAT
947ba630b4d2d998525eff4f08a5f9a0f45052b51fab71c7838ffae57ab0e4f5
RemcosRAT
b670e59f539f07cfa6e43d69a9792f1fa38cf6dbdd92bca0db08511727e9308d
RemcosRAT
d3d7cf78c75f38bab6a8da2535b26b58eaf60a49daf48bbba906e4437530c9cc
RemcosRAT
+ 4'430 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:remotehost discovery persistence rat
Link:
https://tria.ge/reports/240906-r1v34s1grp/
Behaviour
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of NtCreateThreadExHideFromDebugger
Adds Run key to start application
Checks computer location settings
Executes dropped EXE
Blocklisted process makes network request
Remcos
Malware Config
C2 Extraction:
privmerkt.com:6042
nwemarkets.com:5290
Unpacked files
SH256 hash:
3c911df5b86df9712bf5f14ff49c3beadb62cbde886609139c437bf0a919fc49
MD5 hash:
35e11c13023ab1ac61074ad93aabaa91
SHA1 hash:
254d8d808f678540ff8a55836e92a444dd2d44e3
Link:
https://www.unpac.me/results/455c6bdb-ce86-4340-89b8-aa1adf7ca0b8/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3c911df5b86df9712bf5f14ff49c3beadb62cbde886609139c437bf0a919fc49

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
Reviews
IDCapabilitiesEvidence
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CloseHandle
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::LoadLibraryExW
KERNEL32.dll::LoadLibraryExA
KERNEL32.dll::GetDriveTypeW
KERNEL32.dll::GetSystemInfo
KERNEL32.dll::GetStartupInfoW
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::WriteConsoleW
KERNEL32.dll::ReadConsoleW
KERNEL32.dll::SetStdHandle
KERNEL32.dll::GetConsoleMode
KERNEL32.dll::GetConsoleCP
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CreateFileW
KERNEL32.dll::CreateFileMappingW
KERNEL32.dll::DeleteFileW
KERNEL32.dll::GetFileAttributesW

Comments