MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 431106d0fae621b288cec117c34a315178103cb6444b3a0c41d841c376a6dcf0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 15


Intelligence 15 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 431106d0fae621b288cec117c34a315178103cb6444b3a0c41d841c376a6dcf0
SHA3-384 hash: aabd9384da2421394ac55cc6f364d4a7dba00311833cd420af0f8773e18581e710c78a3f19a695d3dfb589d19aa38f6f
SHA1 hash: 4880900293b4178484fc58d94a44cb6bae261292
MD5 hash: ab6e19f3e3b1e103622c8ee0890773c3
humanhash: asparagus-lima-tennessee-uniform
File name:UGHPO654ED.exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'031'680 bytes
First seen:2023-05-23 06:05:16 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'749 x AgentTesla, 19'653 x Formbook, 12'246 x SnakeKeylogger)
ssdeep 24576:Cppb6wb5nkQLJogqdDBi3Tn+2+J9S6J/FBHfIXYuMGwGY:Cr6G5nkeoPBgcvxJ95fcRMGw
Threatray 2'007 similar samples on MalwareBazaar
TLSH T1B42501DBCA464461CC650BF84032EE7992337FF579B6921E99DA7C73B6772C30822486
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):PE icon
dhash icon 0307612c88000000 (65 x AgentTesla, 47 x RemcosRAT, 9 x MassLogger)
Reporter abuse_ch
Tags:exe RAT RemcosRAT


Avatar
abuse_ch
RemcosRAT C2:
194.147.140.144:1993

Intelligence

File Origin
# of uploads :
1
# of downloads :
292
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
remcos
Create hunting rule
ID:
1
File name:
UGHPO654ED.exe
Verdict:
Malicious activity
Analysis date:
2023-05-23 06:08:05 UTC
Tags:
rat remcos keylogger
Link:
https://app.any.run/tasks/060aa8d3-18dc-4ebf-b2cd-aaf535d20e79

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Win32.PWSX-gen.12535.7870.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Launching a process
Creating a process with a hidden window
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
comodo formbook packed remcos
Link:
https://www.filescan.io/uploads/646c57cb58680c1bcc8ad5b9/reports/5ade94e4-0b82-4298-b153-0bf4ea8016e2/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/431106d0fae621b288cec117c34a315178103cb6444b3a0c41d841c376a6dcf0
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
REMCOS
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/56fb7310-e21e-43b8-8e76-cb70a16fb8ca
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
rans.troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1240502
Signature
Adds a directory exclusion to Windows Defender
C2 URLs / IPs found in malware configuration
Contains functionality to bypass UAC (CMSTPLUA)
Contains functionality to modify clipboard data
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Contains functionalty to change the wallpaper
Delayed program exit found
Found malware configuration
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Remcos
Sigma detected: Scheduled temp file as task from temp location
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Remcos RAT
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 873512 Sample: UGHPO654ED.exe Startdate: 23/05/2023 Architecture: WINDOWS Score: 100 46 Found malware configuration 2->46 48 Malicious sample detected (through community Yara rule) 2->48 50 Sigma detected: Scheduled temp file as task from temp location 2->50 52 6 other signatures 2->52 7 RbsNRl.exe 5 2->7         started        10 UGHPO654ED.exe 7 2->10         started        process3 file4 56 Multi AV Scanner detection for dropped file 7->56 58 Contains functionality to bypass UAC (CMSTPLUA) 7->58 60 Contains functionalty to change the wallpaper 7->60 66 6 other signatures 7->66 13 schtasks.exe 1 7->13         started        15 RbsNRl.exe 7->15         started        36 C:\Users\user\AppData\Roaming\RbsNRl.exe, PE32 10->36 dropped 38 C:\Users\user\...\RbsNRl.exe:Zone.Identifier, ASCII 10->38 dropped 40 C:\Users\user\AppData\Local\...\tmp914E.tmp, XML 10->40 dropped 42 C:\Users\user\AppData\...\UGHPO654ED.exe.log, ASCII 10->42 dropped 62 Uses schtasks.exe or at.exe to add and modify task schedules 10->62 64 Adds a directory exclusion to Windows Defender 10->64 17 UGHPO654ED.exe 2 2 10->17         started        22 powershell.exe 21 10->22         started        24 schtasks.exe 1 10->24         started        26 UGHPO654ED.exe 10->26         started        signatures5 process6 dnsIp7 28 conhost.exe 13->28         started        44 194.147.140.144, 1993 PTPEU unknown 17->44 34 C:\ProgramData\remcos\logs.dat, data 17->34 dropped 54 Installs a global keyboard hook 17->54 30 conhost.exe 22->30         started        32 conhost.exe 24->32         started        file8 signatures9 process10
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/431106d0fae621b288cec117c34a315178103cb6444b3a0c41d841c376a6dcf0/
Threat name:
ByteCode-MSIL.Trojan.RemcosRAT
Create hunting rule
Status:
Malicious
First seen:
2023-05-23 06:06:05 UTC
File Type:
PE (.Net Exe)
Extracted files:
16
AV detection:
23 of 36 (63.89%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=imiqnuh24yq3fcgoyel4gsrrkf4bapfwirftudcb3ba4g5vg3tya._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
0491bc38e6e0832364a57ee8264c6e7ae42ba800abe522292c8b3c35c1df44d2
RemcosRAT
180fb1754473bf66ac639baf329875582efa35331da108954b658107be7f2781
RemcosRAT
1950034453da28649135d35016d5ab7ee791cd4bbbc1e4a72f7c56ce3aa9dd9a
RemcosRAT
1aad8a04f82d296e91f7fa3d3c0ec03ae6eb0239f1bc43e8d2dbdc70772ccc94
RemcosRAT
47c74b216015a03abc6bf2a786c4c760fe23f5ce920c9a0ed6e68aa340568e84
RemcosRAT
52a13a4d61a25202abe50d85c42d4b3aac7e364af1100233c28cf06e4598882e
RemcosRAT
85574a66e3fbb37b82be9171860a77e52033ca6d877f5eb46011ef5d470cbe93
RemcosRAT
8cf00d2afc13dfb147426c04aa2e0f01185ece5cc6d33f0c24dab812fcb2ddc5
RemcosRAT
973c7cf900b8d3fe8f945e15c64e4d786a659ea779196a0bb3fa135f3026c70e
RemcosRAT
9fb34ea7f261881a74fc5e2b25f1ecf329c16430c9fe5942738d71d0223ae046
RemcosRAT
+ 1'997 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:mopol rat
Link:
https://tria.ge/reports/230523-gtq6gaeh5w/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Checks computer location settings
Remcos
Malware Config
C2 Extraction:
194.147.140.144:1993
Unpacked files
SH256 hash:
cb5ee4cfd7179a57298c02ce4ccc9c2ca6b0b310758a7320340cf0a40ab62f88
MD5 hash:
0dd66dbaf510e93ec00b9eadf5ec34b6
SHA1 hash:
b7e1b7bbf2d58cc03beeb7095ae98e03426f39a7
Link:
https://www.unpac.me/results/aab24bde-f20a-4711-86e0-0189af133740/
SH256 hash:
8bf2ee285cebbebeaca86474c97657e123b314d03383b964dd7928d2b7e23db7
MD5 hash:
f561c3722c5da9af408e616e7a1b0900
SHA1 hash:
a08880e3a2351b486c887c4237cd3eac8c6579bb
Link:
https://www.unpac.me/results/aab24bde-f20a-4711-86e0-0189af133740/
SH256 hash:
16c255190eaaf1b60ec7d07abcac5f614ea197cee2416ca9d01bb563c526c87d
MD5 hash:
fb4ed205b442f470bbf10913128efdcb
SHA1 hash:
9a0a4c5ae429769e3253a9a3daefa24270b87a5b
Link:
https://www.unpac.me/results/aab24bde-f20a-4711-86e0-0189af133740/
Parent samples :
ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397
de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e
SH256 hash:
a0394e1f90cc58f9b40b1b25a79d02421402c2c6641a5d3972eae0093d7c2c19
MD5 hash:
365b414bc3f22291df6d0b23ff3f1e3c
SHA1 hash:
733617dc58e7d9b7701a1b60610294b74414fcdb
Detections:
Remcos
Create hunting rule
win_remcos_auto
Create hunting rule
Link:
https://www.unpac.me/results/aab24bde-f20a-4711-86e0-0189af133740/
SH256 hash:
6226094947106788a6398a60b8e1e7c648594585cdd924527d6dd3c43d290e0c
MD5 hash:
85751ce068b83d61dbd33ff7c35851d0
SHA1 hash:
47808fd7aba907de55d140fcffab05505408eaaf
Link:
https://www.unpac.me/results/aab24bde-f20a-4711-86e0-0189af133740/
SH256 hash:
431106d0fae621b288cec117c34a315178103cb6444b3a0c41d841c376a6dcf0
MD5 hash:
ab6e19f3e3b1e103622c8ee0890773c3
SHA1 hash:
4880900293b4178484fc58d94a44cb6bae261292
Link:
https://www.unpac.me/results/aab24bde-f20a-4711-86e0-0189af133740/
Malware family:
Remcos
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/431106d0fae6/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/431106d0fae621b288cec117c34a315178103cb6444b3a0c41d841c376a6dcf0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments