MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4d1cfc06d50c33a02572d8d32f34c277bb89bad8d2932c4e0549409d98d5ddda. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 10


Intelligence 10 IOCs 1 YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4d1cfc06d50c33a02572d8d32f34c277bb89bad8d2932c4e0549409d98d5ddda
SHA3-384 hash: 16026128a8e33573b0aea7ada8cf19770303ce0e9defdd00825c76d40b36e6cd202f606686f8c147ee13bca9c0d80494
SHA1 hash: da4be22b8ed29d1c9b64c42b9187fb4d35dcd6b8
MD5 hash: 8ff19eca3aefdbe10902bb8e3b3d3484
humanhash: triple-west-kitten-tennessee
File name:complete order list 2022.jpg .exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'172'144 bytes
First seen:2022-03-08 06:55:50 UTC
Last seen:2022-03-08 09:03:00 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'461 x Formbook, 12'202 x SnakeKeylogger)
ssdeep 24576:BISSfVvnftRpSVrk65/gzQQ1AM2qikHHQM/OmheTKao0In:BI3VRpS5lq3X2qxHz/zv
TLSH T19145D010DAAA103BF27F9A791BC4E9274AE7F6660200E2FE2C1CC6590FD167D9C81D75
Reporter abuse_ch
Tags:exe RAT RemcosRAT


Avatar
abuse_ch
RemcosRAT C2:
194.31.98.58:2404

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
194.31.98.58:2404 https://threatfox.abuse.ch/ioc/392934/

Intelligence

File Origin
# of uploads :
2
# of downloads :
244
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/248089/
Detection(s):
SecuriteInfo.com.Trojan.Inject4.27826.25790.3123.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Sending a custom TCP request
Сreating synchronization primitives
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a process from a recently created file
Creating a process with a hidden window
Creating a file in the %temp% directory
Launching a process
Unauthorized injection to a recently created process
Creating a file
Setting a keyboard event handler
Enabling autorun by creating a file
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/62934b01-c8c3-40fa-9048-bbb588ede441
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/952302
Signature
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
Contains functionality to inject code into remote processes
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Delayed program exit found
Detected unpacking (creates a PE file in dynamic memory)
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Suspect Svchost Activity
Sigma detected: Suspicious Add Scheduled Task From User AppData Temp
Sigma detected: Suspicious Svchost Process
Sigma detected: Suspicius Schtasks From Env Var Folder
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Instant Messenger accounts or passwords
Uses an obfuscated file name to hide its real file extension (double extension)
Uses dynamic DNS services
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM3
Yara detected Remcos RAT
Yara detected WebBrowserPassView password recovery tool
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 584783 Sample: complete order list 2022.jpg .exe Startdate: 08/03/2022 Architecture: WINDOWS Score: 100 41 store-images.s-microsoft.com 2->41 45 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->45 47 Malicious sample detected (through community Yara rule) 2->47 49 Multi AV Scanner detection for dropped file 2->49 51 22 other signatures 2->51 8 complete order list 2022.jpg .exe 7 2->8         started        signatures3 process4 file5 33 C:\Users\user\AppData\...\DhcdhGYBrpxac.exe, PE32 8->33 dropped 35 C:\...\DhcdhGYBrpxac.exe:Zone.Identifier, ASCII 8->35 dropped 37 C:\Users\user\AppData\Local\...\tmpC7C3.tmp, XML 8->37 dropped 39 C:\...\complete order list 2022.jpg .exe.log, ASCII 8->39 dropped 57 Adds a directory exclusion to Windows Defender 8->57 59 Injects a PE file into a foreign processes 8->59 12 complete order list 2022.jpg .exe 3 2 8->12         started        16 powershell.exe 25 8->16         started        18 schtasks.exe 1 8->18         started        signatures6 process7 dnsIp8 43 primetoolz.duckdns.org 194.31.98.58, 2404, 49764, 49766 BURSABILTR Netherlands 12->43 61 Installs a global keyboard hook 12->61 63 Injects a PE file into a foreign processes 12->63 20 complete order list 2022.jpg .exe 2 12->20         started        23 complete order list 2022.jpg .exe 1 12->23         started        25 iexplore.exe 12->25         started        31 2 other processes 12->31 27 conhost.exe 16->27         started        29 conhost.exe 18->29         started        signatures9 process10 signatures11 53 Tries to harvest and steal browser information (history, passwords, etc) 20->53 55 Tries to steal Instant Messenger accounts or passwords 23->55
Detection:
remcos
Create hunting rule
Link:
https://mwdb.cert.pl/sample/4d1cfc06d50c33a02572d8d32f34c277bb89bad8d2932c4e0549409d98d5ddda/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-03-08 06:56:13 UTC
File Type:
PE (.Net Exe)
Extracted files:
5
AV detection:
19 of 27 (70.37%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=juopybwvbqz2ajls3djs6ngco65ytowy2kjsytqfjfaj3ggv3xna._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:remotehost brand:microsoft collection phishing rat spyware stealer
Link:
https://tria.ge/reports/220308-hqdlmsccd2/
Behaviour
Creates scheduled task(s)
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Detected potential entity reuse from brand microsoft.
Suspicious use of SetThreadContext
Accesses Microsoft Outlook accounts
Reads user/profile data of web browsers
NirSoft WebBrowserPassView
Nirsoft
Remcos
Malware Config
C2 Extraction:
primetoolz.duckdns.org:2404
Unpacked files
SH256 hash:
744180482a5d8fe5f5ccdac8f0dcffe2180ded741737b67dd51768b992aca34e
MD5 hash:
acbbb3d0c25f5ccd3d82f070f5642528
SHA1 hash:
fa1136e94fd7c35108690345a7680a3acf9d0bd1
Link:
https://www.unpac.me/results/d6c3fb29-723c-4d04-b9e0-cbfe415fbae2/
SH256 hash:
57025e5fdc5fd830faee5a3faf08f6b3c9a11ff4e432b10e3cede3119b649c27
MD5 hash:
4c5f684fc48ba1d7d681279f98104015
SHA1 hash:
e1272042e5db77e96ea67cbd5aeb8972485047b5
Link:
https://www.unpac.me/results/d6c3fb29-723c-4d04-b9e0-cbfe415fbae2/
SH256 hash:
175285bfa8a73b3990f54994b8825c1f3396635bc344939cd8d9fc60b9569b46
MD5 hash:
f26eb90c6addfc99fa0c2e63896216d2
SHA1 hash:
77e01b96d8c211d4d24fc0a1aae91122caf5f668
Link:
https://www.unpac.me/results/d6c3fb29-723c-4d04-b9e0-cbfe415fbae2/
SH256 hash:
e3f773aeecd0175f8fced3179dc01ef341fddf2ee8479eb465edb76280a63e63
MD5 hash:
0f596946a2d351be7d8ed68d98fac665
SHA1 hash:
3353fb60d79c99553003418fef82e1ee811a226a
Link:
https://www.unpac.me/results/d6c3fb29-723c-4d04-b9e0-cbfe415fbae2/
SH256 hash:
4d1cfc06d50c33a02572d8d32f34c277bb89bad8d2932c4e0549409d98d5ddda
MD5 hash:
8ff19eca3aefdbe10902bb8e3b3d3484
SHA1 hash:
da4be22b8ed29d1c9b64c42b9187fb4d35dcd6b8
Link:
https://www.unpac.me/results/d6c3fb29-723c-4d04-b9e0-cbfe415fbae2/
Malware family:
Remcos
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/4d1cfc06d50c/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4d1cfc06d50c33a02572d8d32f34c277bb89bad8d2932c4e0549409d98d5ddda

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/248089/

Comments