MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 50eca9149b4ca5e7ae52720cf8827515a1be68e3d8df8606ad5a49ce0cce4b7f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 16


Intelligence 16 IOCs YARA 14 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 50eca9149b4ca5e7ae52720cf8827515a1be68e3d8df8606ad5a49ce0cce4b7f
SHA3-384 hash: 0b5f997b747262f36f0c792864f87a694138e1fe11b5335b54c1afc281b7a31ab98b4985ba040dce1be69dfd0545bb33
SHA1 hash: f7eefa9ef2430c9389e4c95d3466a3f4da036800
MD5 hash: 337794874d8df40f89b513deac94c4fa
humanhash: mountain-neptune-beer-massachusetts
File name:LC-2257ITVA22001508.exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'567'232 bytes
First seen:2024-02-22 18:16:14 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 948cc502fe9226992dce9417f952fce3 (1'182 x CredentialFlusher, 446 x Formbook, 231 x AgentTesla)
ssdeep 24576:gqDEvCTbMWu7rQYlBQcBiT6rprG8a2c9QMY6hALgIqK1w53QCPJGnLZOVI:gTvC/MTQYxsWR7a2c9e6sgP53QCxHV
Threatray 3'968 similar samples on MalwareBazaar
TLSH T19775E202E2CF8322EE76DDF24FFDA211476A7D1D01EAD51E0AD63865A97006D312F663
TrID 68.8% (.CPL) Windows Control Panel Item (generic) (57583/11/19)
12.5% (.EXE) Win64 Executable (generic) (10523/12/4)
6.0% (.EXE) Win16 NE executable (generic) (5038/12/1)
5.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.4% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon 33f098f69290f031 (1 x RemcosRAT, 1 x Formbook)
Reporter lowmal3
Tags:exe RemcosRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
353
Origin country :
DE DE
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/477441/
Detection(s):
SecuriteInfo.com.Trojan.Generic.33203615.28472.17882.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% directory
Launching a process
Сreating synchronization primitives
DNS request
Connection attempt
Sending a custom TCP request
Sending an HTTP GET request
Creating a file
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
autoit fingerprint keylogger lolbin packed remcos shell32
Link:
https://www.filescan.io/uploads/65d78f9e7ec1345fd9817b28/reports/f8854fc6-992a-4c8a-b900-0208043f6dba/overview
Verdict:
Malicious
Labled as:
Strictor.Generic
Link:
https://www.hybrid-analysis.com/sample/50eca9149b4ca5e7ae52720cf8827515a1be68e3d8df8606ad5a49ce0cce4b7f
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
REMCOS
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/8855913c-52c1-4c50-b74d-ad300c39557d
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
rans.troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1397156
Signature
Antivirus detection for URL or domain
Binary is likely a compiled AutoIt script file
C2 URLs / IPs found in malware configuration
Connects to many ports of the same IP (likely port scanning)
Contains functionality to bypass UAC (CMSTPLUA)
Contains functionality to register a low level keyboard hook
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Contains functionalty to change the wallpaper
Delayed program exit found
Found API chain indicative of sandbox detection
Found malware configuration
Installs a global keyboard hook
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
Sigma detected: Remcos
System process connects to network (likely due to code injection or exploit)
Uses dynamic DNS services
Writes to foreign memory regions
Yara detected Remcos RAT
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1397156 Sample: LC-2257ITVA22001508.exe Startdate: 22/02/2024 Architecture: WINDOWS Score: 100 35 ktssav1.ddns.net 2->35 37 geoplugin.net 2->37 45 Found malware configuration 2->45 47 Malicious sample detected (through community Yara rule) 2->47 49 Antivirus detection for URL or domain 2->49 53 8 other signatures 2->53 10 LC-2257ITVA22001508.exe 4 2->10         started        signatures3 51 Uses dynamic DNS services 35->51 process4 signatures5 61 Binary is likely a compiled AutoIt script file 10->61 63 Found API chain indicative of sandbox detection 10->63 13 LC-2257ITVA22001508.exe 2 10->13         started        16 svchost.exe 10->16         started        process6 signatures7 65 Binary is likely a compiled AutoIt script file 13->65 18 LC-2257ITVA22001508.exe 2 13->18         started        21 svchost.exe 13->21         started        67 Contains functionality to bypass UAC (CMSTPLUA) 16->67 69 Contains functionalty to change the wallpaper 16->69 71 Contains functionality to steal Chrome passwords or cookies 16->71 73 3 other signatures 16->73 process8 signatures9 43 Binary is likely a compiled AutoIt script file 18->43 23 LC-2257ITVA22001508.exe 2 18->23         started        26 svchost.exe 18->26         started        process10 signatures11 55 Binary is likely a compiled AutoIt script file 23->55 57 Writes to foreign memory regions 23->57 59 Maps a DLL or memory area into another process 23->59 28 svchost.exe 3 15 23->28         started        process12 dnsIp13 39 geoplugin.net 178.237.33.50, 49700, 80 ATOM86-ASATOM86NL Netherlands 28->39 41 ktssav1.ddns.net 104.254.90.243, 49699, 52748 AMANAHA-NEWCA Canada 28->41 33 C:\ProgramData\remcos\logs.dat, data 28->33 dropped 75 System process connects to network (likely due to code injection or exploit) 28->75 77 Installs a global keyboard hook 28->77 file14 signatures15
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/50eca9149b4ca5e7ae52720cf8827515a1be68e3d8df8606ad5a49ce0cce4b7f
Detection:
remcos
Create hunting rule
Link:
https://mwdb.cert.pl/sample/50eca9149b4ca5e7ae52720cf8827515a1be68e3d8df8606ad5a49ce0cce4b7f/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2024-02-22 18:17:08 UTC
File Type:
PE (Exe)
Extracted files:
25
AV detection:
18 of 24 (75.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=kdwksfe3jss6plssoigpratvcwq342hd3dpymbvnlje44dgojn7q._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
280945c850b2ee81256b36dacdec35b2bbc147c3cba57b344cd50bf464d74f97
RemcosRAT
3cb93d166196c1400e069fd437153d956df26d587c969c2c1a525874633a1e99
RemcosRAT
6234e49bf7956d3dcceda1ef8e631c3794df29a6a29afa2e2a1dfa18abbd1153
RemcosRAT
7c81d05dd82233e0278c83ca0b1a3b3ad9f0fa4b8b56bef98bba964752369754
RemcosRAT
a7a695a309a4d733be36d20b77c293291bfaf421cd6244b4e46119fcab63141e
RemcosRAT
+ 3'958 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:file rat
Link:
https://tria.ge/reports/240222-ww1j9aea44/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Remcos
Malware Config
C2 Extraction:
ktssav1.ddns.net:52748
Unpacked files
SH256 hash:
55759a0f696f01cff17dcc7d48a21687dbbee5ee16aceef6766223976172c40d
MD5 hash:
5e0dfb3b811fd13b9319c125bd34fc7d
SHA1 hash:
734f36b859a773a73f08f19c9bceb7d35678d4a8
Detections:
Remcos
Create hunting rule
win_remcos_w0
Create hunting rule
win_remcos_auto
Create hunting rule
malware_windows_remcos_rat
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
Create hunting rule
Link:
https://www.unpac.me/results/6fabe619-3fde-4348-b721-11039f89a8b4/
SH256 hash:
50eca9149b4ca5e7ae52720cf8827515a1be68e3d8df8606ad5a49ce0cce4b7f
MD5 hash:
337794874d8df40f89b513deac94c4fa
SHA1 hash:
f7eefa9ef2430c9389e4c95d3466a3f4da036800
Detections:
AutoIT_Compiled
Create hunting rule
Link:
https://www.unpac.me/results/6fabe619-3fde-4348-b721-11039f89a8b4/
Malware family:
Remcos
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/50eca9149b4c/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/50eca9149b4ca5e7ae52720cf8827515a1be68e3d8df8606ad5a49ce0cce4b7f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AutoIT_Compiled
Create hunting rule
Author:@bartblaze
Description:Identifies compiled AutoIT script (as EXE). This rule by itself does NOT necessarily mean the detected file is malicious.
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:iexplorer_remcos
Create hunting rule
Author:iam-py-test
Description:Detect iexplorer being taken over by Remcos
Rule name:INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
Create hunting rule
Author:ditekSHen
Description:Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:Remcos
Create hunting rule
Author:kevoreilly
Description:Remcos Payload
Rule name:REMCOS_RAT_variants
Create hunting rule
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Windows_Trojan_Remcos_b296e965
Create hunting rule
Author:Elastic Security
Reference:https://www.elastic.co/security-labs/exploring-the-ref2731-intrusion-set
Rule name:win_remcos_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.remcos.
Rule name:win_remcos_w0
Create hunting rule
Author:Matthew @ Embee_Research
Description:Detects strings present in remcos rat Samples.
Rule name:yarahub_win_remcos_rat_unpacked_aug_2023
Create hunting rule
Author:Matthew @ Embee_Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

Executable exe 50eca9149b4ca5e7ae52720cf8827515a1be68e3d8df8606ad5a49ce0cce4b7f

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/477441/

Comments