MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4ab073f5eb82cd26d4c4ecb978119ca00eb1d4627f88e894563b1ed9ae0ed5d8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 12


Intelligence 12 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4ab073f5eb82cd26d4c4ecb978119ca00eb1d4627f88e894563b1ed9ae0ed5d8
SHA3-384 hash: 90dbfee6ff2a6c669c5c8535040434132b580550ab44ce4cee83106f318d5bf2aafa74b93e596cec1da6a0530bfaeb38
SHA1 hash: c111805da53355f3e9c73cc62a16b9ccf4c537e3
MD5 hash: 5a08f69d84eb7894cb78e92e64554b10
humanhash: zebra-bacon-mango-april
File name:na
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:18'238 bytes
First seen:2024-11-01 19:46:46 UTC
Last seen:2024-11-02 16:15:27 UTC
File type:HTML Application (hta) hta
MIME type:text/html
ssdeep 384:ersOobc2zpo+h3L9J6GCBJmJzhgMTyWH2bFDWbFdEc49P919+FnPHWokvEiyq2MW:erdolpF7eLwq2MiP
Threatray 4'565 similar samples on MalwareBazaar
TLSH T1F082E07B6D8C2014F74AC5B4DDFA403F47E6EADAD0D6D09426C4EED18C76C8AF296848
Magika vba
Reporter abuse_ch
Tags:hta RemcosRAT

Intelligence

File Origin
# of uploads :
2
# of downloads :
100
Origin country :
DE DE
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.DownLoader47.48921.5678.22866.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
94.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=672530f08d23d9049132903e
Tags:
powershell gumen spam
Result
Verdict:
Malicious
File Type:
HTA File - Malicious
Link:
https://app.docguard.net/4ab073f5eb82cd26d4c4ecb978119ca00eb1d4627f88e894563b1ed9ae0ed5d8/results/dashboard
Behaviour
BlacklistAPI detected
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
dropper packed powershell
Link:
https://www.filescan.io/uploads/6725303de9959538ff3c2a93/reports/526d7b8f-9d7c-4736-8999-00b8ba875b47/overview
Verdict:
Malicious
Labled as:
TrojanDownloader/VBS.Maloader
Link:
https://www.hybrid-analysis.com/sample/4ab073f5eb82cd26d4c4ecb978119ca00eb1d4627f88e894563b1ed9ae0ed5d8
Result
Verdict:
UNKNOWN
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
rans.troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1547087
Signature
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
C2 URLs / IPs found in malware configuration
Contains functionality to bypass UAC (CMSTPLUA)
Contains functionality to register a low level keyboard hook
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Contains functionalty to change the wallpaper
Creates autostart registry keys with suspicious names
Delayed program exit found
Detected Remcos RAT
Found malware configuration
Injects a PE file into a foreign processes
Loading BitLocker PowerShell Module
Machine Learning detection for dropped file
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Powershell drops PE file
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Remcos
Sigma detected: Scheduled temp file as task from temp location
Sigma detected: Suspect Svchost Activity
Sigma detected: Suspicious MSHTA Child Process
Suricata IDS alerts for network traffic
Suspicious powershell command line found
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected Remcos RAT
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1547087 Sample: na.hta Startdate: 01/11/2024 Architecture: WINDOWS Score: 100 123 Suricata IDS alerts for network traffic 2->123 125 Found malware configuration 2->125 127 Malicious sample detected (through community Yara rule) 2->127 129 11 other signatures 2->129 13 mshta.exe 1 2->13         started        16 bXbaAKkaFi.exe 2->16         started        18 remcos.exe 2->18         started        20 2 other processes 2->20 process3 dnsIp4 165 Suspicious powershell command line found 13->165 23 powershell.exe 15 17 13->23         started        167 Multi AV Scanner detection for dropped file 16->167 169 Machine Learning detection for dropped file 16->169 171 Injects a PE file into a foreign processes 16->171 28 bXbaAKkaFi.exe 16->28         started        30 schtasks.exe 16->30         started        32 remcos.exe 18->32         started        34 schtasks.exe 18->34         started        105 127.0.0.1 unknown unknown 20->105 36 remcos.exe 20->36         started        38 schtasks.exe 20->38         started        40 remcos.exe 20->40         started        signatures5 process6 dnsIp7 107 185.196.11.151, 49710, 80 SIMPLECARRIERCH Switzerland 23->107 97 C:\Users\user\AppData\...\5wrhYo8GRfUzSQH.exe, PE32 23->97 dropped 139 Powershell drops PE file 23->139 42 5wrhYo8GRfUzSQH.exe 6 23->42         started        46 conhost.exe 23->46         started        48 conhost.exe 23->48         started        141 Detected Remcos RAT 28->141 50 conhost.exe 30->50         started        52 conhost.exe 34->52         started        54 conhost.exe 38->54         started        file8 signatures9 process10 file11 101 C:\Users\user\AppData\...\bXbaAKkaFi.exe, PE32 42->101 dropped 103 C:\Users\user\AppData\Local\...\tmp57C8.tmp, XML 42->103 dropped 149 Multi AV Scanner detection for dropped file 42->149 151 Contains functionality to bypass UAC (CMSTPLUA) 42->151 153 Contains functionalty to change the wallpaper 42->153 155 8 other signatures 42->155 56 5wrhYo8GRfUzSQH.exe 42->56         started        60 powershell.exe 23 42->60         started        62 powershell.exe 23 42->62         started        64 schtasks.exe 42->64         started        signatures12 process13 file14 99 C:\ProgramData\Remcos\remcos.exe, PE32 56->99 dropped 143 Detected Remcos RAT 56->143 145 Creates autostart registry keys with suspicious names 56->145 66 remcos.exe 56->66         started        147 Loading BitLocker PowerShell Module 60->147 69 conhost.exe 60->69         started        71 conhost.exe 62->71         started        73 conhost.exe 64->73         started        signatures15 process16 signatures17 131 Multi AV Scanner detection for dropped file 66->131 133 Machine Learning detection for dropped file 66->133 135 Adds a directory exclusion to Windows Defender 66->135 137 Injects a PE file into a foreign processes 66->137 75 remcos.exe 66->75         started        79 powershell.exe 66->79         started        81 powershell.exe 66->81         started        83 schtasks.exe 66->83         started        process18 dnsIp19 109 66.63.162.79, 2404, 49771 ASN-QUADRANET-GLOBALUS United States 75->109 157 Detected Remcos RAT 75->157 159 Writes to foreign memory regions 75->159 161 Maps a DLL or memory area into another process 75->161 85 svchost.exe 75->85         started        163 Loading BitLocker PowerShell Module 79->163 87 conhost.exe 79->87         started        89 conhost.exe 81->89         started        signatures20 process21 process22 91 chrome.exe 85->91         started        dnsIp23 111 192.168.2.6, 2404, 443, 49705 unknown unknown 91->111 113 192.168.2.5 unknown unknown 91->113 115 2 other IPs or domains 91->115 94 chrome.exe 91->94         started        process24 dnsIp25 117 mdec.nelreports.net 94->117 119 js.monitor.azure.com 94->119 121 9 other IPs or domains 94->121
Score:
98%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/4ab073f5eb82cd26d4c4ecb978119ca00eb1d4627f88e894563b1ed9ae0ed5d8
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4ab073f5eb82cd26d4c4ecb978119ca00eb1d4627f88e894563b1ed9ae0ed5d8/
Threat name:
Script-WScript.Trojan.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2024-10-30 11:35:22 UTC
File Type:
Text (VBS)
AV detection:
11 of 38 (28.95%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jkyhh5plqlgsnvge5s4xqem4uahldvdcp6eorfcwhmpntlqo2xma._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
unknown_loader_037
Create hunting rule
Similar samples:
0751a8aa6a5a7b05bca94d02f3b5d7907455db416f6d7caa2e79a55f51033f98
RemcosRAT
0bc8eae9fe2dc6af83e1b798f9a6b5ef27117c5b8462664a944fca34a4e1e464
RemcosRAT
2cabc41b8e44e0101ceca0923c6abbd2459aabeff1831d700f2cfd1e3487dc20
RemcosRAT
c42c5e19c13ff40e49a51fb71208e781b24e116527260e2620ad7f665892962b
RemcosRAT
ec66f68731b1c186ac1c87c2520106f85e2a25951303014b9163f51c476846be
RemcosRAT
error
RemcosRAT
+ 4'555 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:remotehost discovery execution persistence rat
Link:
https://tria.ge/reports/241101-yrywzaveql/
Behaviour
Modifies Internet Explorer settings
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Adds Run key to start application
Executes dropped EXE
Loads dropped DLL
Blocklisted process makes network request
Command and Scripting Interpreter: PowerShell
Downloads MZ/PE file
Remcos
Remcos family
Malware Config
C2 Extraction:
66.63.162.79:2404
Malware family:
Remcos
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/4ab073f5eb82/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.30
Link:
https://yomi.yoroi.company/submissions/4ab073f5eb82cd26d4c4ecb978119ca00eb1d4627f88e894563b1ed9ae0ed5d8

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RemcosRAT

HTML Application (hta) hta 4ab073f5eb82cd26d4c4ecb978119ca00eb1d4627f88e894563b1ed9ae0ed5d8

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3270109/
  
Delivery method
Distributed via web download

Comments