MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4185f3b1d930ba69d0ce56cc57c84ea8cc1a0e716c4cc38034b2a11d9f7a4d75. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	4185f3b1d930ba69d0ce56cc57c84ea8cc1a0e716c4cc38034b2a11d9f7a4d75
SHA3-384 hash:	3577f2fcb5e2d257e20deee43a420d03333025b0028a984ed6d77dc2e548e610f0af104eda5770da531ef9368e76dda8
SHA1 hash:	e8df5f574f4e82e888b7461a90463eeefaa07448
MD5 hash:	b2efe15b9de4f877fb4c18c61ff61320
humanhash:	romeo-yellow-skylark-uniform
File name:	rfqlastquaterproductpurchaseorderimportlist09.bat
Download:	download sample
Signature	RemcosRAT Alert Create hunting rule
File size:	4'808 bytes
First seen:	2024-09-09 05:10:17 UTC
Last seen:	2024-09-11 20:17:47 UTC
File type:	bat
MIME type:	text/plain
ssdeep	96:Kdtov/JcXC2dYF1R7LboDlYk3Pz4mgs8548uguKFK16XHbOwh:AovRcXjE1VCqIrgH4k1K16Xbbh
TLSH	T1B8A11A7C0697E26920EE969531BAA0272AD1743A8E474431957F0390E847F37F64EC2F
Magika	powershell
Reporter	abuse_ch
Tags:	bat RAT RemcosRAT

abuse_ch

RemcosRAT C2:
43.226.229.234:57484

Intelligence

---

File Origin

# of uploads :

3

# of downloads :

173

Origin country :

NL

Vendor Threat Intelligence

ANY.RUN guloader

Malware family:

guloader

Alert

Create hunting rule

ID:

1

File name:

rfqlastquaterproductpurchaseorderimportlist09.bat

Verdict:

Malicious activity

Analysis date:

2024-09-09 05:11:53 UTC

Tags:

guloader loader rat remcos keylogger stealer mpress evasion

Link:

https://app.any.run/tasks/7778c8fe-6dfe-41e2-af47-8294d20c1806

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

ClamAV Detected

Detection(s):

Sanesecurity.Malware.30643.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=66de83672b43a28a71757d74

Tags:

Encryption Execution Generic Network Stealth

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

masquerade

Link:

https://www.filescan.io/uploads/66de83667fd554a24b9b3b89/reports/c4619ae5-9bc9-451a-b424-f39a52bc9e90/overview

Hybrid Analysis Troj/BatDl

Verdict:

Suspicious

Labled as:

Troj/BatDl

Link:

https://www.hybrid-analysis.com/sample/4185f3b1d930ba69d0ce56cc57c84ea8cc1a0e716c4cc38034b2a11d9f7a4d75

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Joe Sandbox GuLoader, Remcos

Result

Threat name:

GuLoader, Remcos

Alert

Create hunting rule

Detection:

malicious

Classification:

phis.troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1507726

Signature

AI detected suspicious sample

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Found malware configuration

Found suspicious powershell code related to unpacking or dynamic code loading

Installs a global keyboard hook

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Multi AV Scanner detection for domain / URL

Obfuscated command line found

Sigma detected: Potential PowerShell Command Line Obfuscation

Sigma detected: Wab/Wabmig Unusual Parent Or Child Processes

Suricata IDS alerts for network traffic

Suspicious powershell command line found

Switches to a custom stack to bypass stack traces

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Instant Messenger accounts or passwords

Tries to steal Mail credentials (via file / registry access)

Tries to steal Mail credentials (via file registry)

Uses dynamic DNS services

Very long command line found

Writes to foreign memory regions

Yara detected GuLoader

Yara detected Powershell download and execute

Yara detected Remcos RAT

Yara detected WebBrowserPassView password recovery tool

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/4185f3b1d930ba69d0ce56cc57c84ea8cc1a0e716c4cc38034b2a11d9f7a4d75

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4185f3b1d930ba69d0ce56cc57c84ea8cc1a0e716c4cc38034b2a11d9f7a4d75/

ReversingLabs TitaniumCloud Script-PowerShell.Trojan.GuLoader

Threat name:

Script-PowerShell.Trojan.GuLoader

Alert

Create hunting rule

Status:

Malicious

First seen:

2024-09-09 04:22:40 UTC

File Type:

Text (Batch)

AV detection:

9 of 24 (37.50%)

Threat level:

  5/5

Spamhaus Hash Blocklist

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=igc7hmozgc5gtugok3gfpscovdgbudtrnrgmhabuwkqr3h32jv2q._file

Threatray unknown

Verdict:

unknown

Hatching Triage guloader

Result

Malware family:

guloader

Alert

Create hunting rule

Score:

  10/10

Tags:

family:guloader collection credential_access discovery downloader execution persistence stealer

Link:

https://tria.ge/reports/240909-ft9r5starr/

Behaviour

Modifies registry key

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Accesses Microsoft Outlook accounts

Adds Run key to start application

Blocklisted process makes network request

Command and Scripting Interpreter: PowerShell

Credentials from Password Stores: Credentials from Web Browsers

Detected Nirsoft tools

NirSoft MailPassView

NirSoft WebBrowserPassView

Guloader,Cloudeye

VMRay Malicious

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/4185f3b1d930/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/4185f3b1d930ba69d0ce56cc57c84ea8cc1a0e716c4cc38034b2a11d9f7a4d75