MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 446fdd51f5eb4359191e189e54a209bd96295c5495cabc1b0b07c8f11d1eb748. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 9


Intelligence 9 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 446fdd51f5eb4359191e189e54a209bd96295c5495cabc1b0b07c8f11d1eb748
SHA3-384 hash: 8ef13fdf4167983f52aa9acf155aaea3a5eb4821ef082303d746d58d6789c637a65ab76fead69dc23c91a42bf1543718
SHA1 hash: 1d81d84d6b21d42c8dc259f84fe82f83d09e7370
MD5 hash: 57d4160dee3edf90191d888cf29826fc
humanhash: oklahoma-seventeen-freddie-sixteen
File name:446fdd51f5eb4359191e189e54a209bd96295c5495cabc1b0b07c8f11d1eb748
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'646'320 bytes
First seen:2021-03-23 08:07:47 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 95b167cf8bdf19781a997108df444e3e (4 x RemcosRAT)
ssdeep 24576:nQh0unxTfhbQzpjHZDNXVbtMCME6J5aRXHGEzuKXPNzdX8ukER9hrtVeh54:QFhMjHN5MC5RXHfRXVzeHERT/
Threatray 1'990 similar samples on MalwareBazaar
TLSH 90758D226E9E4837C02716344C5FA365693ABF003E24865B67F45D4CDF3A790BC292BB
Reporter JAMESWT_WT
Tags:RemcosRAT signed TORG-ALYANS LLC

Code Signing Certificate

Organisation:TORG-ALYANS, LLC
Issuer:DigiCert EV Code Signing CA (SHA2)
Algorithm:sha256WithRSAEncryption
Valid from:2020-08-05T00:00:00Z
Valid to:2021-08-10T12:00:00Z
Serial number: 084b6f19898214a02a5f32e6ea69f0fd
Intelligence: 2 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: fd28631701a8d5469f659ef65dee85d00a8fea761f855a951f58a94667d463a5
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
136
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
PhoenixBios 2.2.1.3.zip
Verdict:
Malicious activity
Analysis date:
2021-03-22 16:22:04 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/c6bae967-19e2-4aef-a811-6166280c698a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/126456/
Detection(s):
PUA.Win.Packer.BorlandCpp-9
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/649534
Signature
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Contains functionality to capture and log keystrokes
Contains functionality to inject code into remote processes
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Detected Remcos RAT
Found malware configuration
Hijacks the control flow in another process
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Sigma detected: Remcos
Writes to foreign memory regions
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 373731 Sample: EgKQxCmJnF Startdate: 23/03/2021 Architecture: WINDOWS Score: 100 26 Found malware configuration 2->26 28 Malicious sample detected (through community Yara rule) 2->28 30 Multi AV Scanner detection for submitted file 2->30 32 4 other signatures 2->32 7 EgKQxCmJnF.exe 2->7         started        process3 signatures4 34 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 7->34 36 Hijacks the control flow in another process 7->36 38 Writes to foreign memory regions 7->38 40 Allocates memory in foreign processes 7->40 10 notepad.exe 7->10         started        process5 signatures6 42 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 10->42 44 Hijacks the control flow in another process 10->44 46 Writes to foreign memory regions 10->46 48 Maps a DLL or memory area into another process 10->48 13 cmd.exe 10->13         started        16 cmd.exe 2 6 10->16         started        process7 dnsIp8 50 Contains functionality to steal Chrome passwords or cookies 13->50 52 Contains functionality to capture and log keystrokes 13->52 54 Contains functionality to inject code into remote processes 13->54 56 Contains functionality to steal Firefox passwords or cookies 13->56 24 185.158.115.38, 49769, 5004 IPSERVER-RU-NETFiordRU Russian Federation 16->24 20 C:\Users\user\AppData\Roaming\Adobe\mmc.exe, PE32 16->20 dropped 22 C:\Users\user\AppData\...\libssp-0.dll, PE32 16->22 dropped 58 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 16->58 file9 signatures10
Detection:
remcos
Create hunting rule
Link:
https://mwdb.cert.pl/sample/446fdd51f5eb4359191e189e54a209bd96295c5495cabc1b0b07c8f11d1eb748/
Threat name:
Win32.Trojan.Bulz
Create hunting rule
Status:
Malicious
First seen:
2021-03-22 22:33:42 UTC
File Type:
PE (Exe)
Extracted files:
140
AV detection:
20 of 48 (41.67%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
0953e54968ca9407a172c0a35a00d8b30ec603770809bbd2901a070e1b83b7f8
RemcosRAT
11f06223417d6045acaa15cf7f5515d9afdfc23590c9cd021c2ae90a736bb6cd
RemcosRAT
411e56b415d4c23a741958c3f1ada72b3e958c078d27c339678bb690b7a895c3
RemcosRAT
67b662f28ef6c6a148443ebece272e63e7eeb9d366032b4366fe459b7c5c41f8
RemcosRAT
6c131f342e8226706ba1b39cc955852b022130c14ea12bd3b3cf340bbea25bf6
RemcosRAT
9a55287be3d6c8a74a0aa6ee3a5ea4e288ba968e44c271c9ea5d2293c8300d07
RemcosRAT
b8ae844621bf21969ca7070937f91101ca4f7277917979ad9d4a4ac43d6e5fad
RemcosRAT
e3670bfc1db6fb7223bb6b231ef4c3afd9d34de1d8f87b7a8e7a4cb27cfaa37d
RemcosRAT
ebb6267e5c3bf10ec8ccba29d6fd2c7b747cef8b758db1544caf9edc7f117d7b
RemcosRAT
f39b9e8c4a9aa6d8cd9f069e8a8ee81a3f666e07071f2b4673aa42633026736c
RemcosRAT
+ 1'980 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/210323-166rgm35dx/
Unpacked files
SH256 hash:
c7fbdc61eb62c05e40295617e2db75877672931f751a770d2629e6eab6075f2c
MD5 hash:
abf6c724b20844d5b0073988a58faf1e
SHA1 hash:
7a8269d5b2ae623f8148ce9863f48f7e12ce036b
Link:
https://www.unpac.me/results/c128839e-c087-4d25-897a-77208f949c30/
SH256 hash:
446fdd51f5eb4359191e189e54a209bd96295c5495cabc1b0b07c8f11d1eb748
MD5 hash:
57d4160dee3edf90191d888cf29826fc
SHA1 hash:
1d81d84d6b21d42c8dc259f84fe82f83d09e7370
Link:
https://www.unpac.me/results/c128839e-c087-4d25-897a-77208f949c30/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/446fdd51f5eb4359191e189e54a209bd96295c5495cabc1b0b07c8f11d1eb748

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:crime_win32_parallax_payload_1
Create hunting rule
Author:@VK_Intel
Description:Detects Parallax Injected Payload v1.01
Reference:https://twitter.com/VK_Intel/status/1227976106227224578
Rule name:crime_win32_rat_parralax_shell_bin
Create hunting rule
Author:@VK_Intel
Description:Detects Parallax injected code
Reference:https://twitter.com/VK_Intel/status/1257714191902937088
Rule name:MAL_crime_win32_rat_parallax_shell_bin
Create hunting rule
Author:@VK_Intel
Description:Detects Parallax injected code
Reference:https://twitter.com/VK_Intel/status/1257714191902937088

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/126456/

Comments