MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 43c39e05ae59835e16df8bd732cd035292db70bc2c2d6d95ac354622bfa376ec. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
RemcosRAT
Vendor detections: 13
| SHA256 hash: | 43c39e05ae59835e16df8bd732cd035292db70bc2c2d6d95ac354622bfa376ec |
|---|---|
| SHA3-384 hash: | 24cf3181a01364c5025e9ea3a666502892826512269fc0e63f06940f7574e0cf455daa2c3f1d9ae8827b3368fcb7e185 |
| SHA1 hash: | 88fdf81626acf5a1b2b561002b5ea6425c7b23fe |
| MD5 hash: | 03dc66eb73f94113115e145a35599724 |
| humanhash: | delaware-eight-london-lithium |
| File name: | 03dc66eb73f94113115e145a35599724 |
| Download: | download sample |
| Signature | RemcosRAT |
| File size: | 1'011'200 bytes |
| First seen: | 2023-05-26 06:23:22 UTC |
| Last seen: | 2023-05-26 07:24:25 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'741 x AgentTesla, 19'606 x Formbook, 12'242 x SnakeKeylogger) |
| ssdeep | 12288:97z5GoJiGaq5auiuHeSV0TL4X10nL8BeBQe90wgYlS+al1JiWYyn54FVHmSI9/VQ:55GoR5aQT0aqF2euimJiWYI4E1OaWoW |
| Threatray | 3'703 similar samples on MalwareBazaar |
| TLSH | T1C325239E322A9927E4963FB095221A7107B17DD43861D3CA1DD937CF2EF5F02462AB43 |
| TrID | 63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 11.2% (.SCR) Windows screen saver (13097/50/3) 9.0% (.EXE) Win64 Executable (generic) (10523/12/4) 5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 3.8% (.EXE) Win32 Executable (generic) (4505/5/1) |
| File icon (PE): |  |
| dhash icon | c4ccccd4d4cccccc (8 x AgentTesla, 7 x Loki, 3 x RemcosRAT) |
| Reporter |  zbetcheckin |
| Tags: | 32 exe RemcosRAT |
Intelligence
File Origin
# of uploads :
2
# of downloads :
272
Origin country :
FRVendor Threat Intelligence
Malware family:
remcos
ID:
1
File name:
cunext new purchase order.doc
Verdict:
Malicious activity
Analysis date:
2023-05-26 05:32:59 UTC
Tags:
exploit cve-2017-11882 loader keylogger remcos
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Detection(s):
Result
Verdict:
Clean
Maliciousness:
Behaviour
Creating a window
Sending a custom TCP request
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
packed
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
REMCOS
Verdict:
Malicious
Result
Threat name:
Remcos
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Signature
.NET source code contains potential unpacker
C2 URLs / IPs found in malware configuration
Contains functionality to bypass UAC (CMSTPLUA)
Contains functionality to modify clipboard data
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Delayed program exit found
Found malware configuration
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Sigma detected: Remcos
Yara detected Remcos RAT
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Pwsx
Status:
Malicious
First seen:
2023-05-26 06:24:05 UTC
File Type:
PE (.Net Exe)
Extracted files:
12
AV detection:
6 of 23 (26.09%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
remcos
Similar samples:
+ 3'693 additional samples on MalwareBazaar
Result
Malware family:
remcos
Score:
10/10
Tags:
family:remcos botnet:remotehost rat
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Remcos
Malware Config
C2 Extraction:
seanblacin.sytes.net:6110
Unpacked files
SH256 hash:
08fd2ab7b4e13878977492cdee02175c2a2afa0d707106ad7d91b1e99e94f95c
MD5 hash:
cf832dd25b486ce2e1258bf604649e88
SHA1 hash:
f3e5504394f24babdfa684925cfc71f07db74d16
SH256 hash:
660a0e60dbd1342b35432a53599a7a1bd6f62d2d350b4de1b48600e7d8d67ad4
MD5 hash:
c4a97d373e8c64e65f316cd487311e6f
SHA1 hash:
b9a60aa1fb129eb2e8cf6022dcc7725349252dd8
Detections:
Remcos
win_remcos_auto
Parent samples :
291755c89bb6d77dd43c74cb0413df8037244debd6bedd2a869edf7dfd090d64
14fb2daf697ee302647b7d63c26e94f443c9516a5a707b85952b1158e5ffe12a
f07ddc7c081b1106a27590e5497bec74f0d48f18b8c49d17ea57fa3d7d0704d8
97e54013704e2edc63c7d31ee30dfba3d2bcdbdd91df650ff0a01e560c3e111a
e2c60159ad9908ac2a1ab446c1866dfe5a59b1535ca29f111ae56833996d82b8
a6bf09d8242fd2933426629a504f995a5d624d555bd2f28a49876762ec0a03a6
43c39e05ae59835e16df8bd732cd035292db70bc2c2d6d95ac354622bfa376ec
14fb2daf697ee302647b7d63c26e94f443c9516a5a707b85952b1158e5ffe12a
f07ddc7c081b1106a27590e5497bec74f0d48f18b8c49d17ea57fa3d7d0704d8
97e54013704e2edc63c7d31ee30dfba3d2bcdbdd91df650ff0a01e560c3e111a
e2c60159ad9908ac2a1ab446c1866dfe5a59b1535ca29f111ae56833996d82b8
a6bf09d8242fd2933426629a504f995a5d624d555bd2f28a49876762ec0a03a6
43c39e05ae59835e16df8bd732cd035292db70bc2c2d6d95ac354622bfa376ec
SH256 hash:
7414647bf91a00051f87d143cf7bac7974fd5dfbc35010f7b0956cc1b97bacec
MD5 hash:
ceb255de4ec28647f19e7d31e816c9ed
SHA1 hash:
a7be78c0b5cdd6ab3bcbedc876a958e40ab0f737
SH256 hash:
16c255190eaaf1b60ec7d07abcac5f614ea197cee2416ca9d01bb563c526c87d
MD5 hash:
fb4ed205b442f470bbf10913128efdcb
SHA1 hash:
9a0a4c5ae429769e3253a9a3daefa24270b87a5b
SH256 hash:
aa55a49c4e26b6c0cfb3aa599f5cb5c6eae65e0a7884458e75614092d073cf5f
MD5 hash:
9d9bed3fb41b5b721aafd13220f48c73
SHA1 hash:
069c54846fffaf8ba3abc8f140a60dd9755ff20a
SH256 hash:
43c39e05ae59835e16df8bd732cd035292db70bc2c2d6d95ac354622bfa376ec
MD5 hash:
03dc66eb73f94113115e145a35599724
SHA1 hash:
88fdf81626acf5a1b2b561002b5ea6425c7b23fe
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Remcos
Score:
0.90
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | iexplorer_remcos |
|---|---|
| Author: | iam-py-test |
| Description: | Detect iexplorer being taken over by Remcos |
| Rule name: | INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM |
|---|---|
| Author: | ditekSHen |
| Description: | Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) |
| Rule name: | pe_imphash |
|---|
| Rule name: | Remcos |
|---|---|
| Author: | kevoreilly |
| Description: | Remcos Payload |
| Rule name: | REMCOS_RAT_variants |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
| Rule name: | Windows_Trojan_Remcos_b296e965 |
|---|---|
| Author: | Elastic Security |
| Rule name: | win_remcos_auto |
|---|---|
| Author: | Felix Bilstein - yara-signator at cocacoding dot com |
| Description: | Detects win.remcos. |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.url : hxxp://194.180.48.59/plugmanzx.exe