MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4791861118e0be776fd14153e2feca7d25f5a91a6c32a997385f5ae272e3d7c8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 10


Intelligence 10 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4791861118e0be776fd14153e2feca7d25f5a91a6c32a997385f5ae272e3d7c8
SHA3-384 hash: 93c03e9c7b2256d3187bcbe9a1714677d5a35e7abfb6e2ff009104b97b646f0902bd61815545d590d32cc4579be340ae
SHA1 hash: 8dc8d08c6c2e802bbcf14212e4225f8ce8f36cd9
MD5 hash: 6436037554a522bc595df49e053ec91b
humanhash: kentucky-april-alaska-fruit
File name:PO2001288DV (MASCHEK).exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:755'200 bytes
First seen:2020-10-07 06:01:20 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'737 x AgentTesla, 19'595 x Formbook, 12'238 x SnakeKeylogger)
ssdeep 12288:gu2BMYSLtBY2KFhKaqLAr+lpBf491W5dhB+eeWSv3BPRDAMCB2qgZeZ1jOfqIYCo:p2BKLtBY2khXqmEpK1WBOW
Threatray 782 similar samples on MalwareBazaar
TLSH D2F418DD726072DFC86BC832D9681C64EA506C7B970B9203942735EDAE6E897DF140F2
Reporter abuse_ch
Tags:exe RAT RemcosRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
124
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Launching a process
Creating a process with a hidden window
Running batch commands
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/483802
Signature
Contains functionality to capture and log keystrokes
Contains functionality to inject code into remote processes
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Detected Remcos RAT
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Remcos
Sigma detected: Scheduled temp file as task from temp location
Sigma detected: Suspicious Svchost Process
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM_3
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 294360 Sample: PO2001288DV (MASCHEK).exe Startdate: 07/10/2020 Architecture: WINDOWS Score: 100 78 cdn.onenote.net 2->78 80 worldglobalrem.serveirc.com 2->80 88 Malicious sample detected (through community Yara rule) 2->88 90 Multi AV Scanner detection for dropped file 2->90 92 Icon mismatch, binary includes an icon from a different legit application in order to fool users 2->92 94 15 other signatures 2->94 12 PO2001288DV (MASCHEK).exe 7 2->12         started        15 remcos.exe 2->15         started        19 remcos.exe 4 2->19         started        signatures3 process4 dnsIp5 70 C:\Users\user\AppData\Roaming\YPozsANh.exe, PE32 12->70 dropped 72 C:\Users\...\YPozsANh.exe:Zone.Identifier, ASCII 12->72 dropped 74 C:\Users\user\AppData\Local\...\tmpFA56.tmp, XML 12->74 dropped 76 C:\Users\...\PO2001288DV (MASCHEK).exe.log, ASCII 12->76 dropped 21 PO2001288DV (MASCHEK).exe 4 5 12->21         started        24 schtasks.exe 1 12->24         started        26 PO2001288DV (MASCHEK).exe 12->26         started        28 svchost.exe 12->28         started        84 192.168.2.1 unknown unknown 15->84 86 Injects a PE file into a foreign processes 15->86 30 schtasks.exe 15->30         started        32 remcos.exe 15->32         started        34 schtasks.exe 19->34         started        36 remcos.exe 19->36         started        38 remcos.exe 19->38         started        file6 signatures7 process8 file9 66 C:\Users\user\AppData\Roaming\...\remcos.exe, PE32 21->66 dropped 68 C:\Users\user\...\remcos.exe:Zone.Identifier, ASCII 21->68 dropped 40 wscript.exe 1 21->40         started        42 conhost.exe 24->42         started        44 conhost.exe 30->44         started        46 conhost.exe 34->46         started        process10 process11 48 cmd.exe 1 40->48         started        process12 50 remcos.exe 5 48->50         started        54 conhost.exe 48->54         started        file13 64 C:\Users\user\AppData\...\remcos.exe.log, ASCII 50->64 dropped 96 Multi AV Scanner detection for dropped file 50->96 98 Machine Learning detection for dropped file 50->98 100 Contains functionality to steal Chrome passwords or cookies 50->100 102 2 other signatures 50->102 56 remcos.exe 50->56         started        60 schtasks.exe 50->60         started        signatures14 process15 dnsIp16 82 worldglobalrem.serveirc.com 185.231.113.3, 3086, 49738, 49739 PTPEU European Union 56->82 104 Tries to harvest and steal browser information (history, passwords, etc) 56->104 62 conhost.exe 60->62         started        signatures17 process18
Detection:
remcos
Create hunting rule
Link:
https://mwdb.cert.pl/sample/4791861118e0be776fd14153e2feca7d25f5a91a6c32a997385f5ae272e3d7c8/
Threat name:
ByteCode-MSIL.Backdoor.NanoCore
Create hunting rule
Status:
Malicious
First seen:
2020-10-07 05:50:19 UTC
File Type:
PE (.Net Exe)
Extracted files:
14
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=i6iymeiy4c7ho36rifj6f7wkpus7lki2nqzktfzyl5noe4xd27ea._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
3ad93466a6cf17944a21b708648e557f7b5ed91866932bbc0bbef14ca9805a70
RemcosRAT
485c1301f4bc84bc2d274f53222cf7ca5fbd8af8728d1aaa977a6574f577fb87
RemcosRAT
50e7b9a736f734ffd4d57d93f93a89e454a4e5147ec7dac2c3f3e5f5fee6fd5f
RemcosRAT
67163c34b396f7fc4a1dec14c1a0e598d5ac5786e6c26f11c8b8b16b31b70f4c
RemcosRAT
76d8f7539bba2cd5acd833f384ad0fb2191ce3553b65416de53869461622b177
RemcosRAT
83eb442b175e4fe5a2fde6e8d72618eee280398f89a81da1f9c118d2c46032d4
RemcosRAT
929aed244ea7ad68ca44b6274a388dcc772b9d4bc6f4e2cb4370555ecc292c80
RemcosRAT
d5b1dfa52d7b7e4a025f3c2c9084005e6e41eb48b81711ae58ab1b641ef99e64
RemcosRAT
e39c2e98071d4440d02e6d1aa86111536d6d01554489bd71f890455c05e424d3
RemcosRAT
ed04192cebc7cfa981cd8e63e350cade7305423021dbd062486f870d574f02a0
RemcosRAT
+ 772 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
rat family:remcos persistence spyware
Link:
https://tria.ge/reports/201007-2c8bxavc2s/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Modifies registry class
Suspicious use of SetThreadContext
Adds Run key to start application
Loads dropped DLL
Reads user/profile data of web browsers
Executes dropped EXE
Remcos
Malware Config
C2 Extraction:
worldglobalrem.serveirc.com:3086
Unpacked files
SH256 hash:
4791861118e0be776fd14153e2feca7d25f5a91a6c32a997385f5ae272e3d7c8
MD5 hash:
6436037554a522bc595df49e053ec91b
SHA1 hash:
8dc8d08c6c2e802bbcf14212e4225f8ce8f36cd9
Link:
https://www.unpac.me/results/51539279-ad69-4875-aab1-a26de6ea8adb/
SH256 hash:
13b24d3a09d099dabe41cd6cd71607a77e14640b1e9b4ed2d60f6c012f191c43
MD5 hash:
109cedae3c384a1913107f1efad2b7c8
SHA1 hash:
1f7f35b0ed85fa12bb839cbce698e59a30813420
Link:
https://www.unpac.me/results/51539279-ad69-4875-aab1-a26de6ea8adb/
SH256 hash:
bddd756428bc3ded95e57f69494540259ee4bcbd854b973223f1ae4093c017cd
MD5 hash:
aad9addbe4c8d83135eee0989781e9dc
SHA1 hash:
6681a4ef55d96b62ed28d8f66932e4dbdee521e8
Link:
https://www.unpac.me/results/51539279-ad69-4875-aab1-a26de6ea8adb/
SH256 hash:
76eb78dbfec84adcf6b28bdc9dc38a39808da43151f393a1938e1bd1b2cdc4b9
MD5 hash:
609797736c43b1d71e0d5c4b739b394f
SHA1 hash:
810c50fd9d744355127a7cdf663d4af8dc1da38f
Detections:
win_remcos_g0
Create hunting rule
win_remcos_auto
Create hunting rule
Link:
https://www.unpac.me/results/51539279-ad69-4875-aab1-a26de6ea8adb/
SH256 hash:
8152e8851ddde66424bf4365560c5742807ea650bb55ee815bf2983c586e2b75
MD5 hash:
3d51483c5a6d714422e6f586799d5675
SHA1 hash:
fdbb6f3e4194f9886ea0b5c410a02b023d64171d
Link:
https://www.unpac.me/results/51539279-ad69-4875-aab1-a26de6ea8adb/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4791861118e0be776fd14153e2feca7d25f5a91a6c32a997385f5ae272e3d7c8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_RemcosRAT
Create hunting rule
Author:abuse.ch
Rule name:Parallax
Create hunting rule
Author:@bartblaze
Description:Identifies Parallax RAT.
Rule name:Remcos
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Remcos in memory
Rule name:win_remcos_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

Executable exe 4791861118e0be776fd14153e2feca7d25f5a91a6c32a997385f5ae272e3d7c8

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/68840/

Comments