MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4f189abe24a0c0b6689720f3b3d4b56288b0c92bb889520dcdf8dd44d33dfe1a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 10


Intelligence 10 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4f189abe24a0c0b6689720f3b3d4b56288b0c92bb889520dcdf8dd44d33dfe1a
SHA3-384 hash: 63aa5b1fc5ae5b1691b77a3f715b3e27ae8836ef4f3a5b8755071ada079631acc65d8d1b91b3ac37be102529ba4a163a
SHA1 hash: ba26835bd0e0ec949148bb256fbf023dca327a9a
MD5 hash: 90579e635d666e791f1834f46e6676d8
humanhash: maine-nineteen-purple-oranges
File name:SOA.exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:42'496 bytes
First seen:2021-09-06 14:17:39 UTC
Last seen:2021-09-06 15:17:05 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 63393299977e5acc51eaba5bf320ad3d (2 x RemcosRAT)
ssdeep 384:kCvBNvdvjKnvcQPf5/RrPJQXulaiAMwCKFH2S3dd0hUADka:NDdjKn0QP7DJxlmMwCK/3deVD
Threatray 561 similar samples on MalwareBazaar
TLSH T13413F71A7882568AC5C47FF82DB19297663A3CE10128C19B9DFBBF68DD72223DCC115D
dhash icon 174f4559191b1b13 (81 x AgentTesla, 68 x Formbook, 34 x SnakeKeylogger)
Reporter James_inthe_box
Tags:exe RemcosRAT

Intelligence

File Origin
# of uploads :
2
# of downloads :
148
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SOA.exe
Verdict:
Suspicious activity
Analysis date:
2021-09-06 14:19:37 UTC
Tags:
rat remcos
Link:
https://app.any.run/tasks/213d0cea-7d31-4eb0-862b-f0485ab74e40

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Remcos
Create hunting rule
Link:
https://www.capesandbox.com/analysis/185688/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
DNS request
Connection attempt
Sending a custom TCP request
Sending an HTTP GET request
Creating a file in the %temp% directory
Unauthorized injection to a recently created process
Sending a UDP request
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/7e0bb2ca-2dc2-42ce-ad5b-1991c36d78b7
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/846047
Signature
Antivirus / Scanner detection for submitted sample
C2 URLs / IPs found in malware configuration
Detected Remcos RAT
Found malware configuration
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4f189abe24a0c0b6689720f3b3d4b56288b0c92bb889520dcdf8dd44d33dfe1a/
Threat name:
Win32.Trojan.Remcos
Create hunting rule
Status:
Malicious
First seen:
2021-09-06 13:41:27 UTC
File Type:
PE (Exe)
Extracted files:
9
AV detection:
20 of 28 (71.43%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=j4mjvpreudalm2exedz3hvfvmkelbsjlxcevedon7doujuz57yna._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
13e6341cacb27fdd36b2ce19395dbb02947f0c917b6fd10447f1d6381d51b7d4
RemcosRAT
2eb44403d1de2a792569f63907f746809e3d4e35fccf689c2e637f77df79254c
RemcosRAT
37c8006f77fa8da7ab579b1bc6c7af01e1cea30ad04d79030d162bff42fc308d
RemcosRAT
7eb677c1c5c60d34da90cab2b4ea019c500b5c3db6964cc14849dbe2f9f5fa30
RemcosRAT
91e8ea3e431c0ad9faf6dfe01eb29e4834940054379deb8b657d9cbe23e91682
RemcosRAT
a737c6bf1fe3e63d6d187d114d887c6c1e722579fc9caab72ce4451564e165f6
RemcosRAT
b56242ce9875402fca36f6d831072462bcf7b0996c2a98d048455459485ade1d
RemcosRAT
e6930000e13aa3deafe16f78fcfca8e6276e18ba6a252b8045dfaf570f044328
RemcosRAT
+ 551 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/210906-rl99gsbbh3/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Unpacked files
SH256 hash:
4f189abe24a0c0b6689720f3b3d4b56288b0c92bb889520dcdf8dd44d33dfe1a
MD5 hash:
90579e635d666e791f1834f46e6676d8
SHA1 hash:
ba26835bd0e0ec949148bb256fbf023dca327a9a
Link:
https://www.unpac.me/results/6bf4ecd3-e303-4468-8a69-a4aaafde1e6e/
Malware family:
Remcos
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/4f189abe24a0/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4f189abe24a0c0b6689720f3b3d4b56288b0c92bb889520dcdf8dd44d33dfe1a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_RemcosRAT
Create hunting rule
Author:abuse.ch
Rule name:INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer
Create hunting rule
Author:ditekSHen
Description:detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Rule name:Remcos
Create hunting rule
Author:kevoreilly
Description:Remcos Payload
Rule name:remcos_rat
Create hunting rule
Author:jeFF0Falltrades
Rule name:REMCOS_RAT_variants
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/185688/

Comments