MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 4aa2ea3cc55b48f3f6e54c75d383592a6fd4fa449908adbc019c3fb676dd5285. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Worm.m0yv
Vendor detections: 17
| SHA256 hash: | 4aa2ea3cc55b48f3f6e54c75d383592a6fd4fa449908adbc019c3fb676dd5285 |
|---|---|
| SHA3-384 hash: | ee4c4c986a4a377b020fa3f71669cb5ed40d38ba9370970b650618ad578f268c129accd6feb2b0d54e18d47a1dad7a77 |
| SHA1 hash: | 69e2079d8d1b6b3b63054ddcb230ed1692215937 |
| MD5 hash: | 155573c10ba4dfaa5e03edbc0ec1693e |
| humanhash: | bulldog-arkansas-maryland-item |
| File name: | 4aa2ea3cc55b48f3f6e54c75d383592a6fd4fa449908adbc019c3fb676dd5285 |
| Download: | download sample |
| Signature | Worm.m0yv |
| File size: | 3'072'211 bytes |
| First seen: | 2024-10-09 11:56:29 UTC |
| Last seen: | 2024-11-07 14:18:17 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | d3bf8a7746a8d1ee8f6e5960c3f69378 (247 x Formbook, 75 x AgentTesla, 64 x SnakeKeylogger) |
| ssdeep | 49152:7JZoQrbTFZY1iaC/xLjwrTEWcVtb/vSNTOHGtLUYTwZwcgRLKLCdjrnSYCFyg8qs:7trbTA1ejwrItTvSNTOmtLtw4RL1rnnd |
| Threatray | 1'113 similar samples on MalwareBazaar |
| TLSH | T1C6E51221B9C69036C2F323B19D7FF7A6DA3D65364336D29B23C82D250EA0541672A773 |
| TrID | 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4504/4/1) |
| Magika | pebin |
| File icon (PE): |  |
| dhash icon | b150b26869b2d471 (468 x Formbook, 101 x RedLineStealer, 94 x AgentTesla) |
| Reporter |  adrian__luca |
| Tags: | exe Worm.m0yv |
Intelligence
File Origin
# of uploads :
3
# of downloads :
366
Origin country :
HUVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
4aa2ea3cc55b48f3f6e54c75d383592a6fd4fa449908adbc019c3fb676dd5285
Verdict:
Malicious activity
Analysis date:
2024-10-09 11:57:12 UTC
Tags:
snake keylogger
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Malicious
Score:
99.9%
Tags:
Nymeria Autoit Emotet Remcos
Verdict:
Likely Malicious
Threat level:
7.5/10
Confidence:
100%
Tags:
autoit epmicrosoft_visual_cc fingerprint keylogger lolbin microsoft_visual_cc overlay packed remcos shell32
Verdict:
Malicious
Labled as:
AIT:Trojan.Nymeria
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Mispadu
Verdict:
Malicious
Result
Threat name:
Remcos
Detection:
malicious
Classification:
spre.phis.troj.spyw.expl.evad
Score:
100 / 100
Signature
AI detected suspicious sample
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Contains functionality to behave differently if execute on a Russian/Kazak computer
Creates files in the system32 config directory
Creates files inside the volume driver (system volume information)
Detected Remcos RAT
Drops executable to a common third party application directory
Drops VBS files to the startup folder
Found direct / indirect Syscall (likely to bypass EDR)
Found malware configuration
Infects executable files (exe, dll, sys, html)
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
Queries random domain names (often used to prevent blacklisting and sinkholes)
Sigma detected: Drops script at startup location
Sigma detected: Remcos
Sigma detected: WScript or CScript Dropper
Suricata IDS alerts for network traffic
Switches to a custom stack to bypass stack traces
System process connects to network (likely due to code injection or exploit)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file / registry access)
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Yara detected Remcos RAT
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Score:
100%
Verdict:
Malware
File Type:
PE
Threat name:
Win32.Backdoor.Remcos
Status:
Malicious
First seen:
2024-09-28 09:34:23 UTC
File Type:
PE (Exe)
Extracted files:
28
AV detection:
26 of 38 (68.42%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
admintool_powerrun
Similar samples:
+ 1'103 additional samples on MalwareBazaar
Result
Malware family:
remcos
Score:
10/10
Tags:
family:remcos botnet:remotehost collection discovery rat spyware stealer
Behaviour
Uses Volume Shadow Copy WMI provider
Uses Volume Shadow Copy service COM API
Checks SCSI registry key(s)
Checks processor information in registry
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: LoadsDriver
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Drops file in Program Files directory
Drops file in Windows directory
AutoIT Executable
Drops file in System32 directory
Suspicious use of SetThreadContext
Accesses Microsoft Outlook accounts
Drops startup file
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Remcos
Malware Config
C2 Extraction:
204.10.160.212:6622
Verdict:
Malicious
Tags:
remcos
YARA:
n/a
Unpacked files
SH256 hash:
12542f0132220b25e2c7793eb3b4b1a981ac9abced64ed8ccc1152552f93f7b9
MD5 hash:
e849ab18d5751f7ade868f065593f10d
SHA1 hash:
95289f5edf10b1f4ca981e5da0831bce9c204708
SH256 hash:
abdd6f31a909b0b10e30ced74a1f6f037adf1f61a8a842048dbc254d6f076169
MD5 hash:
c33a7f0e25bb3f4d3c19fc8441e9d12b
SHA1 hash:
0286b277e97b9f7c217a0d029e8144f8e20b40b9
SH256 hash:
bd739fc857f093d7872961b0b12eeca7b404879744ae6b2dc494729a887112de
MD5 hash:
71e3f6ac8f6c00e23146a0fe79cb5b4e
SHA1 hash:
8072b333010655c940b5229458f0bd8bef9664d0
SH256 hash:
fca2781352241570ff980adf2f43845e3e1e3b2dd4ba3d65f316a4fcc06dfd13
MD5 hash:
dbea1b8786b9f0a8e73635e4ba137fa4
SHA1 hash:
b86493d834235ced006d2331f344436bdf609582
SH256 hash:
05cfd2a4b72bceeba53fe23910252a330939b434ea4219cda78c7dbae21ba27d
MD5 hash:
cfb3bfd309582c3ebf95e35ad44c3642
SHA1 hash:
8d4fa44fb0680561454e906e2e1e7a2519212d73
SH256 hash:
81ccd88d0d8979bf36c91b313155d652354c07ce82706b7d74bf8792481323d8
MD5 hash:
302de2b2d2d4aa66973a4f2a56496dee
SHA1 hash:
78c7ffa280e82bcd7c885a3a07a25b51092b7eab
Detections:
Remcos
win_remcos_w0
malware_windows_remcos_rat
INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
win_remcos_rat_unpacked
SH256 hash:
2dde5d99ad4f464ff19638125724deb5f54eacbf4b122ae47da8d9afeeb83bb3
MD5 hash:
74d7d2a6d114cc50d2586298293e1293
SHA1 hash:
82205224b8846abd2ecfd237dfb8a6a4fd077c4c
Detections:
AutoIT_Compiled
SH256 hash:
a9c4791e6320f7cbbdb52530842bc932ab5f2040028677217b9f8cbeb63f9ee1
MD5 hash:
321cd8e6847b294cc9d99b31c08bf62b
SHA1 hash:
cd64a03ca213b23780af91a5441b2e09a2860237
Detections:
Remcos
win_remcos_w0
malware_windows_remcos_rat
INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
win_remcos_rat_unpacked
SH256 hash:
7da3684b19485eb02ff32a7d2a444c82948e4a42bd437c8e3bdc25045d54bcba
MD5 hash:
6f715eee215191dda3208dd433b1d639
SHA1 hash:
b7f0b34c4f01eb0bb6f34332f0b1232bd49e23f9
SH256 hash:
861f1b650095f4b428fee7287d51f3bb8165722dd0c99d54a934ce5ae9c8c4a6
MD5 hash:
12f946140b13b0bc0520eb7e4e004a80
SHA1 hash:
31f8f73e41425a66aec05d7dc5a1745a956ac798
Detections:
AutoIT_Compiled
SH256 hash:
754e8b1db92b84e8c7e1544a57045f0952c5351cc8f63ea537af3f0f55847380
MD5 hash:
17925d7749c17dbcb73e1102703f0da7
SHA1 hash:
fe7ba7437733472388c5e4244bbf0139e034c0ef
Detections:
AutoIT_Compiled
SH256 hash:
4aa2ea3cc55b48f3f6e54c75d383592a6fd4fa449908adbc019c3fb676dd5285
MD5 hash:
155573c10ba4dfaa5e03edbc0ec1693e
SHA1 hash:
69e2079d8d1b6b3b63054ddcb230ed1692215937
Detections:
AutoIT_Compiled
Malware family:
Remcos
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | AutoIt |
|---|---|
| Author: | Jean-Philippe Teissier / @Jipe_ |
| Description: | AutoIT packer |
| Rule name: | AutoIT_Compiled |
|---|---|
| Author: | @bartblaze |
| Description: | Identifies compiled AutoIT script (as EXE). This rule by itself does NOT necessarily mean the detected file is malicious. |
| Rule name: | DebuggerCheck__API |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | MD5_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for MD5 constants |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
No further information available
BLint
The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.
Findings
| ID | Title | Severity |
|---|---|---|
| CHECK_AUTHENTICODE | Missing Authenticode | high |
| CHECK_DLL_CHARACTERISTICS | Missing dll Security Characteristics (HIGH_ENTROPY_VA) | high |
| CHECK_NX | Missing Non-Executable Memory Protection | critical |
| CHECK_PIE | Missing Position-Independent Executable (PIE) Protection | high |
Reviews
| ID | Capabilities | Evidence |
|---|---|---|
| AUTH_API | Manipulates User Authorization | ADVAPI32.dll::CopySid ADVAPI32.dll::GetLengthSid ADVAPI32.dll::GetAce USER32.dll::GetUserObjectSecurity ADVAPI32.dll::InitializeAcl ADVAPI32.dll::InitializeSecurityDescriptor |
| COM_BASE_API | Can Download & Execute components | ole32.dll::CLSIDFromProgID ole32.dll::CoCreateInstance ole32.dll::CoCreateInstanceEx ole32.dll::CoInitializeSecurity ole32.dll::CreateStreamOnHGlobal |
| MULTIMEDIA_API | Can Play Multimedia | WINMM.dll::mciSendStringW WINMM.dll::timeGetTime WINMM.dll::waveOutSetVolume |
| SECURITY_BASE_API | Uses Security Base API | ADVAPI32.dll::AddAce ADVAPI32.dll::AdjustTokenPrivileges ADVAPI32.dll::DuplicateTokenEx ADVAPI32.dll::GetAclInformation ADVAPI32.dll::GetSecurityDescriptorDacl ADVAPI32.dll::GetTokenInformation |
| SHELL_API | Manipulates System Shell | SHELL32.dll::ShellExecuteExW SHELL32.dll::ShellExecuteW SHELL32.dll::SHFileOperationW |
| WIN32_PROCESS_API | Can Create Process and Threads | ADVAPI32.dll::CreateProcessAsUserW KERNEL32.dll::CreateProcessW ADVAPI32.dll::CreateProcessWithLogonW KERNEL32.dll::OpenProcess ADVAPI32.dll::OpenProcessToken ADVAPI32.dll::OpenThreadToken |
| WIN_BASE_API | Uses Win Base API | KERNEL32.dll::TerminateProcess KERNEL32.dll::SetSystemPowerState KERNEL32.dll::LoadLibraryW KERNEL32.dll::LoadLibraryExW KERNEL32.dll::LoadLibraryA KERNEL32.dll::GetDriveTypeW |
| WIN_BASE_EXEC_API | Can Execute other programs | KERNEL32.dll::WriteConsoleW KERNEL32.dll::SetStdHandle KERNEL32.dll::GetConsoleCP KERNEL32.dll::GetConsoleMode |
| WIN_BASE_IO_API | Can Create Files | KERNEL32.dll::CopyFileW KERNEL32.dll::CreateDirectoryW KERNEL32.dll::CreateHardLinkW KERNEL32.dll::CreateFileW KERNEL32.dll::DeleteFileW KERNEL32.dll::MoveFileW |
| WIN_BASE_USER_API | Retrieves Account Information | KERNEL32.dll::GetComputerNameW ADVAPI32.dll::GetUserNameW ADVAPI32.dll::LogonUserW ADVAPI32.dll::LookupPrivilegeValueW |
| WIN_NETWORK_API | Supports Windows Networking | MPR.dll::WNetAddConnection2W MPR.dll::WNetUseConnectionW |
| WIN_REG_API | Can Manipulate Windows Registry | ADVAPI32.dll::RegConnectRegistryW ADVAPI32.dll::RegCreateKeyExW ADVAPI32.dll::RegDeleteKeyW ADVAPI32.dll::RegOpenKeyExW ADVAPI32.dll::RegQueryValueExW ADVAPI32.dll::RegSetValueExW |
| WIN_SVC_API | Can Manipulate Windows Services | ADVAPI32.dll::OpenSCManagerW ADVAPI32.dll::UnlockServiceDatabase |
| WIN_USER_API | Performs GUI Actions | USER32.dll::BlockInput USER32.dll::CloseDesktop USER32.dll::CreateMenu USER32.dll::EmptyClipboard USER32.dll::FindWindowExW USER32.dll::FindWindowW |
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.