MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4177cb74219e4ff3d5453eba44a7a0c149591bd3b4eadfe52972567f317d40c3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 11


Intelligence 11 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4177cb74219e4ff3d5453eba44a7a0c149591bd3b4eadfe52972567f317d40c3
SHA3-384 hash: a667a0f839ab69183439df4fa11431bb452d9066fd36ad2f2581f31367ee318385e46c2aec5779eef83e1d0ffa0359e4
SHA1 hash: 25627168ad478fc60dda122cd615f5619f521f3c
MD5 hash: a2675756b369cac95cfad7cceaa50fa1
humanhash: mike-music-romeo-rugby
File name:SecuriteInfo.com.Variant.Lazy.234727.5091.13105
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:24'576 bytes
First seen:2022-08-19 04:29:33 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'600 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 384:EsEmRJdl22M2h3M5LdnOrC7LOyyexQVBDdQnY3ngXRoyBy:EME2pM5H/OBexQVBy/Royw
Threatray 1'704 similar samples on MalwareBazaar
TLSH T12CB2F94BE78C6A61C926C6FDD493C5780290AB5168EECD1E3075B74326337E9CA05D4F
TrID 72.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.4% (.EXE) Win64 Executable (generic) (10523/12/4)
6.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.4% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon 9b1979616969612b (42 x RemcosRAT, 6 x AgentTesla, 5 x Formbook)
Reporter SecuriteInfoCom
Tags:exe RemcosRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
352
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.Variant.Lazy.234727.5091.13105
Verdict:
No threats detected
Analysis date:
2022-08-19 04:32:59 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/80f971de-096e-4226-9b37-c1ede4eca8cf

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/299708/
Detection(s):
SecuriteInfo.com.Variant.Lazy.234727.5091.13105.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
DNS request
Sending a custom TCP request
Sending an HTTP GET request
Launching a process
Creating a process with a hidden window
Creating a file in the %AppData% subdirectories
Creating a file
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Query of malicious DNS domain
Unauthorized injection to a system process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/62ff11cdeb0bf1e2c6ed234b/reports/aa2b6567-840b-44b3-b2f3-c6055ee7cf24/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/3eac49a1-cdb7-4794-a01e-12756b3332b7
Result
Threat name:
AsyncRAT, Remcos
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1054199
Signature
.NET source code contains potential unpacker
Allocates memory in foreign processes
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Encrypted powershell cmdline option found
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Writes to foreign memory regions
Yara detected AsyncRAT
Yara detected Generic Downloader
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 686716 Sample: SecuriteInfo.com.Variant.La... Startdate: 19/08/2022 Architecture: WINDOWS Score: 100 50 obologs.work.gd 2->50 54 Multi AV Scanner detection for domain / URL 2->54 56 Malicious sample detected (through community Yara rule) 2->56 58 Antivirus detection for URL or domain 2->58 60 8 other signatures 2->60 8 SecuriteInfo.com.Variant.Lazy.234727.5091.exe 16 7 2->8         started        13 Fyurg.exe 14 4 2->13         started        15 Fyurg.exe 3 2->15         started        signatures3 process4 dnsIp5 52 transfer.sh 144.76.136.153, 443, 49688, 49697 HETZNER-ASDE Germany 8->52 42 C:\Users\user\AppData\Roaming\...\Fyurg.exe, PE32 8->42 dropped 44 C:\Users\user\...\Fyurg.exe:Zone.Identifier, ASCII 8->44 dropped 46 SecuriteInfo.com.V...234727.5091.exe.log, ASCII 8->46 dropped 62 Encrypted powershell cmdline option found 8->62 64 Writes to foreign memory regions 8->64 66 Allocates memory in foreign processes 8->66 17 aspnet_compiler.exe 2 8->17         started        20 powershell.exe 14 8->20         started        22 aspnet_compiler.exe 8->22         started        68 Multi AV Scanner detection for dropped file 13->68 70 Machine Learning detection for dropped file 13->70 72 Injects a PE file into a foreign processes 13->72 24 powershell.exe 14 13->24         started        26 aspnet_compiler.exe 13->26         started        28 aspnet_compiler.exe 13->28         started        34 2 other processes 13->34 30 powershell.exe 15->30         started        32 aspnet_compiler.exe 15->32         started        file6 signatures7 process8 dnsIp9 48 obologs.work.gd 194.5.98.244, 4044, 49693, 49694 DANILENKODE Netherlands 17->48 36 conhost.exe 20->36         started        38 conhost.exe 24->38         started        40 conhost.exe 30->40         started        process10
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4177cb74219e4ff3d5453eba44a7a0c149591bd3b4eadfe52972567f317d40c3/
Threat name:
ByteCode-MSIL.Trojan.Remcos
Create hunting rule
Status:
Malicious
First seen:
2022-08-19 04:13:59 UTC
File Type:
PE (.Net Exe)
Extracted files:
3
AV detection:
19 of 26 (73.08%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=if34w5bbtzh7hvkfh25ejj5ayfevsg6twtvn7zjjojlh6ml5idbq._file
Verdict:
malicious
Label(s):
masslogger
Create hunting rule
remcos
Create hunting rule
Similar samples:
2929451852384ac9f1b289746f767b752e04ec5d778b9538ac761cb175006948
RemcosRAT
317977d99bebf5f65a24d6460fa2f98f5e875d1f85f12a430acb69f8dd3dfbdf
RemcosRAT
48d97367a91454e04e0161675bc323aaea552ef9335c57090e0d471d3d28c97e
RemcosRAT
ac1906fa0c648d42c3e1b0c7b70b0e7c0c68888d90dc48c81b225f0932cdb258
RemcosRAT
b06040b023873e257e3cc5d803186e714ad4de74fd3bb305205550e5ce5233f7
RemcosRAT
b0e78152cf5f5eca9be7cc47e833600e77db47786c09cc2be451f310c50881d9
RemcosRAT
cce110eed95c36bf618669b1a290ee90b5152ee9c660b6b37f3e11dca7431419
RemcosRAT
cd5f1820af33d2e6f034ca088a5fd83592835c722aca63d9f4912ea2e7996d00
RemcosRAT
ceb6fcadd0f96521026c478596bbc3ba3dfdd3ecdbb2d9e4e8f5bb4a422e446d
RemcosRAT
ec0a3b7d3636b52ae025418ec21669e06c30f58930f11303571a2af6993ef365
RemcosRAT
+ 1'694 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:remotehost persistence rat
Link:
https://tria.ge/reports/220819-e4tcgagdan/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Checks computer location settings
Remcos
Malware Config
C2 Extraction:
obologs.work.gd:4044
Unpacked files
SH256 hash:
4177cb74219e4ff3d5453eba44a7a0c149591bd3b4eadfe52972567f317d40c3
MD5 hash:
a2675756b369cac95cfad7cceaa50fa1
SHA1 hash:
25627168ad478fc60dda122cd615f5619f521f3c
Link:
https://www.unpac.me/results/0ac2eee4-b923-4f1a-9646-f7f0363670fc/
Malware family:
Remcos
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/4177cb74219e/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.38
Link:
https://yomi.yoroi.company/submissions/4177cb74219e4ff3d5453eba44a7a0c149591bd3b4eadfe52972567f317d40c3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/299708/

Comments