MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 54b874aa168963924382bcadb4e63d087c7dbf587a52f16df9efa19157f700b2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 10


Intelligence 10 IOCs YARA 10 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 54b874aa168963924382bcadb4e63d087c7dbf587a52f16df9efa19157f700b2
SHA3-384 hash: d4298b1ffd7af16de1a2f9707fad2df5343945d5d0327003fd6fd664cbcc823bef5a85f39cea61233708a2f92fc85aa4
SHA1 hash: 8d203a1473eb53e9fe87b38bb66bc8d701535285
MD5 hash: 92a796d32256c200d3d3059c69de74a4
humanhash: helium-quiet-gee-don
File name:PO0900009.exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:172'723 bytes
First seen:2021-04-29 12:09:43 UTC
Last seen:2021-04-29 13:21:50 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash ea4e67a31ace1a72683a99b80cf37830 (70 x Formbook, 63 x GuLoader, 54 x Loki)
ssdeep 3072:kEre7GjyCaFvcWM1S6hFv45Im8G9VQ58e9UcWr4AbZjUdvZzIPfhNxn6a:kPXw29SuE7vimXIPfhD6a
Threatray 2'761 similar samples on MalwareBazaar
TLSH 27F3015C6670C4E7C71313B059BA1A53AFFA8D1410B6138BB764ABAD3A365C18C1FF92
Reporter Anonymous
Tags:RemcosRAT

Intelligence

File Origin
# of uploads :
2
# of downloads :
106
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
PO0900009.exe
Verdict:
Malicious activity
Analysis date:
2021-04-29 12:10:20 UTC
Tags:
rat remcos
Link:
https://app.any.run/tasks/6464f154-6693-4e8e-8ee4-cad9049c992b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/146648/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a file
Creating a file in the %AppData% subdirectories
Unauthorized injection to a recently created process
Setting a keyboard event handler
Connection attempt
Sending a UDP request
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/702199
Signature
C2 URLs / IPs found in malware configuration
Contains functionality to capture and log keystrokes
Contains functionality to detect virtual machines (IN, VMware)
Contains functionality to inject code into remote processes
Contains functionality to register a low level keyboard hook
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Detected Remcos RAT
Detected unpacking (changes PE section rights)
Found malware configuration
Installs a global keyboard hook
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Remcos
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 400019 Sample: PO0900009.exe Startdate: 29/04/2021 Architecture: WINDOWS Score: 100 40 Multi AV Scanner detection for domain / URL 2->40 42 Found malware configuration 2->42 44 Malicious sample detected (through community Yara rule) 2->44 46 7 other signatures 2->46 6 PO0900009.exe 1 21 2->6         started        11 aiaf.exe 17 2->11         started        13 aiaf.exe 17 2->13         started        process3 dnsIp4 34 192.168.2.1 unknown unknown 6->34 26 C:\Users\user\AppData\Roaming\...\aiaf.exe, PE32 6->26 dropped 28 C:\Users\user\AppData\...\ycphcnmmr30h8eb.dll, PE32 6->28 dropped 48 Detected unpacking (changes PE section rights) 6->48 50 Contains functionality to detect virtual machines (IN, VMware) 6->50 52 Contains functionality to steal Chrome passwords or cookies 6->52 60 3 other signatures 6->60 15 PO0900009.exe 1 2 6->15         started        30 C:\Users\user\AppData\...\ycphcnmmr30h8eb.dll, PE32 11->30 dropped 54 Multi AV Scanner detection for dropped file 11->54 56 Contains functionality to capture and log keystrokes 11->56 58 Maps a DLL or memory area into another process 11->58 20 aiaf.exe 11->20         started        32 C:\Users\user\AppData\...\ycphcnmmr30h8eb.dll, PE32 13->32 dropped 22 aiaf.exe 13->22         started        file5 signatures6 process7 dnsIp8 36 185.222.58.152, 49707, 49713, 49722 ROOTLAYERNETNL Netherlands 15->36 24 C:\Users\user\AppData\Roaming\...\logs.dat, ASCII 15->24 dropped 38 Installs a global keyboard hook 15->38 file9 signatures10
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/54b874aa168963924382bcadb4e63d087c7dbf587a52f16df9efa19157f700b2/
Threat name:
Win32.Trojan.Predator
Create hunting rule
Status:
Malicious
First seen:
2021-04-29 06:02:18 UTC
AV detection:
30 of 47 (63.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ks4hjkqwrfrzeq4cxsw3jzr5bb6h3p2ypjjpc3pz56qzcv7xacza._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
033f4d8bd914597ee146ea8761a3f79fceb4f49af99f411e9ee94775ed298179
RemcosRAT
0b39a4fbccfbe395762a7c497dd64cea9236fb1c156075f290131c2531c53deb
RemcosRAT
1048c4ebb7be3641037e402bfcc4e8aa667fc49dc82b9690b96b5ea69dd11e50
RemcosRAT
126b33c2868dde525221c47721ba9860b9c172d7c8ab74238a8d3f28f04bbb68
RemcosRAT
19c85373616be5338b379799fa36c19e4ff5d5e7f67fa820ea9040ab5427d516
RemcosRAT
210560d23e3c023c90bd24ed0d76c68732dc267277fc6adcc3c991cb611bb06a
RemcosRAT
643ea3d68bdce21956bd3cd8126fa04c8c199c8c01a86dfa1b57f71eb321cf76
RemcosRAT
a5b12e2ac3b1a01783989acfe7e00c29dd53fa953f88963b9207b38a3f5b4547
RemcosRAT
b8059fc344b91a7b02e6a15a94551fcb3450f1109ad59bd6f3a22e0342ad9ff5
RemcosRAT
cc3bb45f7ae048de5c4a33a22f97d7e7e4b592a990bfe403606c2627cf441b02
RemcosRAT
+ 2'751 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos persistence rat
Link:
https://tria.ge/reports/210429-qz11yq1c9a/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Loads dropped DLL
Remcos
Unpacked files
SH256 hash:
adb89dda6285e09a24ff43fb71b94126a4a66c9b3319bfa300ab92e7b103e655
MD5 hash:
a2f6bef2275decc2f61687e3240892d6
SHA1 hash:
91a0dafd3cb00b305e66e228479685daf8e33461
Link:
https://www.unpac.me/results/483e53d4-3690-465b-b258-7d73dc7fcdc7/
SH256 hash:
54b874aa168963924382bcadb4e63d087c7dbf587a52f16df9efa19157f700b2
MD5 hash:
92a796d32256c200d3d3059c69de74a4
SHA1 hash:
8d203a1473eb53e9fe87b38bb66bc8d701535285
Link:
https://www.unpac.me/results/483e53d4-3690-465b-b258-7d73dc7fcdc7/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/54b874aa168963924382bcadb4e63d087c7dbf587a52f16df9efa19157f700b2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Chrome_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Chrome in files like avemaria
Rule name:INDICATOR_EXE_Packed_MPress
Create hunting rule
Author:ditekSHen
Description:Detects executables built or packed with MPress PE compressor
Rule name:INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer
Create hunting rule
Author:ditekSHen
Description:detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Rule name:Keylog_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Contains Keylog
Rule name:Remcos
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Remcos in memory
Rule name:remcos_rat
Create hunting rule
Author:jeFF0Falltrades
Rule name:REMCOS_RAT_variants
Create hunting rule
Rule name:suspicious_packer_section
Create hunting rule
Author:@j0sm1
Description:The packer/protector section names/keywords
Reference:http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/
Rule name:win_remcos_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_remcos_g0
Create hunting rule
Author:Daniel Plohmann <daniel.plohmann<at>fkie.fraunhofer.de>

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/146648/

Comments