MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4e4463e40d78f3eb63012ed1f3aa7727d98ff68fc9c7b69cf6c0f482c9483476. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 9


Intelligence 9 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4e4463e40d78f3eb63012ed1f3aa7727d98ff68fc9c7b69cf6c0f482c9483476
SHA3-384 hash: c379c5359cf956aa336e3f72ea580a478dd17e4fc90425d3c471de40a3e9943f42dad27afc651c93c8dbfe1ca6394a5d
SHA1 hash: 6078afb7314e042c44cfa671da25c41a0ff06665
MD5 hash: da9793d65d5e9b1ecd2ef6dfb73c6342
humanhash: timing-mountain-asparagus-march
File name:PO_20210.EXE
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:521'708 bytes
First seen:2021-06-02 18:53:31 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash ea4e67a31ace1a72683a99b80cf37830 (70 x Formbook, 64 x GuLoader, 54 x Loki)
ssdeep 12288:Tq+xlwbz7vmIzsTaHK+FloHFsTdUznQYQL6j/C:Tq+xlwbnmIATaHK+DolQiQD6G
Threatray 247 similar samples on MalwareBazaar
TLSH 41B423563607E0F7E36BA3BA0D322B4BD319D1211434339B53ACEE09F95A6C3525E791
Reporter malwarelabnet
Tags:exe remcos RemcosRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
209
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
PO_20210.EXE
Verdict:
Malicious activity
Analysis date:
2021-06-02 19:07:27 UTC
Tags:
rat remcos
Link:
https://app.any.run/tasks/d85656a2-497d-4af6-8815-263595ef8e49

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/164183/
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/796198
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Delayed program exit found
Detected Remcos RAT
Found malware configuration
Initial sample is a PE file and has a suspicious name
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Writes to foreign memory regions
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 428596 Sample: PO_20210.EXE Startdate: 02/06/2021 Architecture: WINDOWS Score: 100 32 Found malware configuration 2->32 34 Malicious sample detected (through community Yara rule) 2->34 36 Antivirus detection for dropped file 2->36 38 8 other signatures 2->38 6 PO_20210.EXE 1 21 2->6         started        10 nmvchnxgq.exe 17 2->10         started        12 nmvchnxgq.exe 17 2->12         started        process3 file4 22 C:\Users\user\AppData\...\nmvchnxgq.exe, PE32 6->22 dropped 24 C:\Users\user\AppData\...\d52eenfw99.dll, PE32 6->24 dropped 40 Writes to foreign memory regions 6->40 42 Maps a DLL or memory area into another process 6->42 14 MSBuild.exe 2 6->14         started        26 C:\Users\user\AppData\...\d52eenfw99.dll, PE32 10->26 dropped 44 Antivirus detection for dropped file 10->44 46 Multi AV Scanner detection for dropped file 10->46 48 Machine Learning detection for dropped file 10->48 18 MSBuild.exe 10->18         started        28 C:\Users\user\AppData\...\d52eenfw99.dll, PE32 12->28 dropped 20 MSBuild.exe 12->20         started        signatures5 process6 dnsIp7 30 79.134.225.17, 2050, 49703, 49708 FINK-TELECOM-SERVICESCH Switzerland 14->30 50 Contains functionality to steal Chrome passwords or cookies 14->50 52 Contains functionality to inject code into remote processes 14->52 54 Contains functionality to steal Firefox passwords or cookies 14->54 56 Delayed program exit found 14->56 signatures8
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4e4463e40d78f3eb63012ed1f3aa7727d98ff68fc9c7b69cf6c0f482c9483476/
Threat name:
Win32.Backdoor.Remcos
Create hunting rule
Status:
Malicious
First seen:
2021-05-05 18:22:32 UTC
AV detection:
26 of 29 (89.66%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jzcghzanpdz6wyybf3i7hktxe7my75upzhd3nhhwyd2ifskigr3a._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
30552657a06df54de322d5d689ca77d2cacbf8e85136ca915843c9a99e4f26c0
RemcosRAT
34ae6e94fd8ce101fadff4baf68d7c0b8bf606d1796b7c8199e7d45a9bc57a02
RemcosRAT
40dc655d06780c3f628f6ec2c3848d797c8ba88dcc50e3397e4e464ec12aaade
RemcosRAT
54b91d6b1324d8b3dec856922b4566b362535d84538297b612c5323e9230daf0
RemcosRAT
8017cf230cb7f4e72b6128a7e696821749c4990dbd446f8206d948c3ed6530ec
RemcosRAT
a0bb5a244b144a8e10087fd70a04580c3bb8c4c8add7da671a06f10020473004
RemcosRAT
af0249150bee4fec74c124f89019cd260c9aacd7b7a7715192b5097f1948eb82
RemcosRAT
c85d33153d768a2f98066c8ba07e58890cbac4c185e4ef45739fb03750e1088b
RemcosRAT
e7510144ab7ab12ed58b249055cf818ae37c82f46d503086cd9933d456b58cb1
RemcosRAT
f9e2ac4c422df790f71f3c1a4a9839edb7405862b1419144f08129400aaa1f6e
RemcosRAT
+ 237 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos persistence rat
Link:
https://tria.ge/reports/210602-8bfxnw8mrs/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Loads dropped DLL
Remcos
Malware Config
C2 Extraction:
79.134.225.17:2050
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.62
Link:
https://yomi.yoroi.company/submissions/4e4463e40d78f3eb63012ed1f3aa7727d98ff68fc9c7b69cf6c0f482c9483476

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_RemcosRAT
Create hunting rule
Author:abuse.ch
Rule name:Chrome_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Chrome in files like avemaria
Rule name:INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer
Create hunting rule
Author:ditekSHen
Description:detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Rule name:Keylog_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Contains Keylog
Rule name:remcos_rat
Create hunting rule
Author:jeFF0Falltrades
Rule name:REMCOS_RAT_variants
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/164183/

Comments