MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 55dcf4931e22917f49fba2dd0f3f923a3135b1d94a1cd026ca875be2a9263cc3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemcosRAT

Vendor detections: 14

Intelligence 14 IOCs YARA 4 File information Comments

SHA256 hash:	55dcf4931e22917f49fba2dd0f3f923a3135b1d94a1cd026ca875be2a9263cc3
SHA3-384 hash:	f32b7e06fa219d7845352de39e0f02f19979e5a56519ca8c4ff30657dc3036159e57293582875290882ec7d12674b8fa
SHA1 hash:	6637145780c85d2de23f71390d1d73b49d4d371d
MD5 hash:	70aa54d297aa60bb3644b8473670eba0
humanhash:	eighteen-golf-social-mars
File name:	1121215454649864153146824555165321215465464651321684351581.exe
Download:	download sample
Signature	RemcosRAT Create hunting rule
File size:	2'212'352 bytes
First seen:	2024-05-06 15:58:21 UTC
Last seen:	2024-05-06 16:38:23 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	6b356d2950e39e695a0e59f99af7cd7e (1 x RemcosRAT)
ssdeep	49152:5R2G/IOhGZuRPR2RGiT5qz7nlkbXS2ethAUNOovvyt:iuGZuvPiEVkVQhpOht
Threatray	2'109 similar samples on MalwareBazaar
TLSH	T100A58D17F7DBC024F5B21B799A3A9501957BBF622C73C20F224C768E9872E534978722
TrID	68.8% (.CPL) Windows Control Panel Item (generic) (57583/11/19) 12.5% (.EXE) Win64 Executable (generic) (10523/12/4) 6.0% (.EXE) Win16 NE executable (generic) (5038/12/1) 5.3% (.EXE) Win32 Executable (generic) (4504/4/1) 2.4% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):
dhash icon	1cb2f8f0f0f8f870 (1 x LummaStealer, 1 x RemcosRAT)
Reporter	Anonymous
Tags:	colombia exe RemcosRAT

Anonymous

This malware was sent from a legitimate account but hacked

Intelligence

File Origin

# of uploads :

# of downloads :

395

Origin country :

Vendor Threat Intelligence

Malware family:

remcos

ID:

File name:

1121215454649864153146824555165321215465464651321684351581.exe

Verdict:

Malicious activity

Analysis date:

2024-05-06 15:50:22 UTC

Tags:

rat remcos remote evasion

Link:

https://app.any.run/tasks/1484e809-5cca-45c8-9f25-4452f6af3072

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

SecuriteInfo.com.Win32.Evo-gen.9588.17712.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Creating a file

Unauthorized injection to a recently created process

Restart of the analyzed sample

Сreating synchronization primitives

Setting a keyboard event handler

DNS request

Connection attempt

Sending a custom TCP request

Sending an HTTP GET request

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

anti-vm anti-vm evasive expand explorer fingerprint lolbin packed risepro runonce shell32

Link:

https://www.filescan.io/uploads/6638fe4854aa07c307ed8f24/reports/3e2e8d6b-47cb-4c9a-8e44-4975586b56b4/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/55dcf4931e22917f49fba2dd0f3f923a3135b1d94a1cd026ca875be2a9263cc3

Malware family:

REMCOS

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/cb9218b1-21f3-435c-ac6a-83b74096c1e4

Result

Threat name:

Remcos

Detection:

malicious

Classification:

rans.troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1436890

Signature

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Contains functionality to bypass UAC (CMSTPLUA)

Contains functionality to register a low level keyboard hook

Contains functionality to steal Chrome passwords or cookies

Contains functionality to steal Firefox passwords or cookies

Contains functionalty to change the wallpaper

Delayed program exit found

Detected Remcos RAT

Drops large PE files

Drops PE files to the document folder of the user

Found malware configuration

Injects a PE file into a foreign processes

Installs a global keyboard hook

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Sigma detected: Remcos

Yara detected Remcos RAT

Yara detected UAC Bypass using CMSTP

Behaviour

Behavior Graph:

Download SVG

Score:

19%

Verdict:

Benign

File Type:

Link:

https://malprob.io/report/55dcf4931e22917f49fba2dd0f3f923a3135b1d94a1cd026ca875be2a9263cc3

Detection:

remcos

Link:

https://mwdb.cert.pl/sample/55dcf4931e22917f49fba2dd0f3f923a3135b1d94a1cd026ca875be2a9263cc3/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=kxopjey6ekix6sp3uloq6p4shiytlmozjionajwkq5n6fkjghtbq._file

Verdict:

malicious

Label(s):

remcos

RemcosRAT

6f31f28d716f4d118974c5fd130a02fb742e20f164ea12b2f1e471f58fa5b817

RemcosRAT

75e017e742b2506cdda2a132759075c7b187ca941df606b34116d0452ef04fd0

RemcosRAT

90aeca3777576bf0d4928c488d1f60752a81cd8fb6050dbb69697116003a5ba5

RemcosRAT

9d8282d54901d4e795f0469a5191242b2e7b3b0c51f810f71c739bfff52de8d5

RemcosRAT

b5ca34b966549dfee1a824ab645c66b17217aadda4ccea96731b8cb0cfb03a27

RemcosRAT

b89f11149cf87734d5e56b24e4b6a604ba3c10a4bcb5ca6567a9f6c595c6a4ab

RemcosRAT

c5898ac379acfcd23bedfceff198bf5e738921bf61b299ca47bdd8c223199515

RemcosRAT

+ 2'099 additional samples on MalwareBazaar

Result

Malware family:

remcos

Score:

10/10

Tags:

family:remcos botnet:mayo persistence rat

Link:

https://tria.ge/reports/240506-te21mshb9w/

Behaviour

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of NtCreateThreadExHideFromDebugger

Adds Run key to start application

Remcos

Malware Config

C2 Extraction:

mayo006.con-ip.com:7770

Unpacked files

SH256 hash:

3eb7de26d2666b5a26b2b33c8262481f9774d85ece1d5756192699b080e33704

MD5 hash:

1238af26af1a9a20fac73476412a9a8a

SHA1 hash:

9faeb0dbdb487b0815aa615ba701c1a12d59d0ab

Detections:

Remcos

win_remcos_w0

win_remcos_auto

malware_windows_remcos_rat

INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM

Link:

https://www.unpac.me/results/d89f12a2-28d0-44f1-8f9f-5a9b4eb950d3/

SH256 hash:

55dcf4931e22917f49fba2dd0f3f923a3135b1d94a1cd026ca875be2a9263cc3

MD5 hash:

70aa54d297aa60bb3644b8473670eba0

SHA1 hash:

6637145780c85d2de23f71390d1d73b49d4d371d

Link:

https://www.unpac.me/results/d89f12a2-28d0-44f1-8f9f-5a9b4eb950d3/

Malware family:

Remcos

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/55dcf4931e22/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/55dcf4931e22917f49fba2dd0f3f923a3135b1d94a1cd026ca875be2a9263cc3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	meth_stackstrings Create hunting rule
Author:	Willi Ballenthin

Rule name:	vmdetect Create hunting rule
Author:	nex
Description:	Possibly employs anti-virtualization techniques

File information

The table below shows additional information about this malware sample such as delivery method and external references.

any.run

https://app.any.run/tasks/1484e809-5cca-45c8-9f25-4452f6af3072

Delivery method

Distributed via e-mail link

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high

Reviews

ID	Capabilities	Evidence
AUTH_API	Manipulates User Authorization	ADVAPI32.dll::AllocateAndInitializeSid ADVAPI32.dll::ConvertSecurityDescriptorToStringSecurityDescriptorW ADVAPI32.dll::ConvertSidToStringSidW ADVAPI32.dll::ConvertStringSecurityDescriptorToSecurityDescriptorW ADVAPI32.dll::ConvertStringSidToSidW ADVAPI32.dll::CopySid
COM_BASE_API	Can Download & Execute components	ole32.dll::CoCreateInstance ole32.dll::CoInitializeSecurity ole32.dll::CreateStreamOnHGlobal
SECURITY_BASE_API	Uses Security Base API	ADVAPI32.dll::AddAce ADVAPI32.dll::AdjustTokenPrivileges ADVAPI32.dll::CheckTokenMembership ADVAPI32.dll::DuplicateToken ADVAPI32.dll::DuplicateTokenEx ADVAPI32.dll::GetAclInformation
WIN32_PROCESS_API	Can Create Process and Threads	ADVAPI32.dll::CreateProcessAsUserW KERNEL32.dll::CreateProcessW KERNEL32.dll::OpenProcess ADVAPI32.dll::OpenProcessToken ADVAPI32.dll::OpenThreadToken KERNEL32.dll::OpenSemaphoreW
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess KERNEL32.dll::LoadLibraryExW KERNEL32.dll::LoadLibraryExA KERNEL32.dll::LoadLibraryW KERNEL32.dll::GetSystemInfo KERNEL32.dll::GetStartupInfoW
WIN_BASE_EXEC_API	Can Execute other programs	KERNEL32.dll::WriteConsoleW KERNEL32.dll::ReadConsoleW KERNEL32.dll::SetStdHandle KERNEL32.dll::GetConsoleMode KERNEL32.dll::GetConsoleCP
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::CopyFileW KERNEL32.dll::CreateDirectoryW KERNEL32.dll::CreateFileW KERNEL32.dll::DeleteFileW KERNEL32.dll::MoveFileW KERNEL32.dll::MoveFileExW SHLWAPI.dll::PathRemoveFileSpecW
WIN_BASE_USER_API	Retrieves Account Information	ADVAPI32.dll::LookupPrivilegeNameW ADVAPI32.dll::LookupPrivilegeValueW KERNEL32.dll::QueryDosDeviceW
WIN_CRYPT_API	Uses Windows Crypt API	CRYPT32.dll::CertFindCertificateInStore CRYPT32.dll::CertFreeCertificateContext CRYPT32.dll::CertGetEnhancedKeyUsage
WIN_REG_API	Can Manipulate Windows Registry	ADVAPI32.dll::RegCreateKeyExW ADVAPI32.dll::RegDeleteKeyW ADVAPI32.dll::RegOpenKeyExW ADVAPI32.dll::RegQueryInfoKeyW ADVAPI32.dll::RegQueryValueExW ADVAPI32.dll::RegSetValueExW
WIN_SVC_API	Can Manipulate Windows Services	ADVAPI32.dll::OpenSCManagerW ADVAPI32.dll::OpenServiceW ADVAPI32.dll::QueryServiceStatusEx ADVAPI32.dll::QueryServiceStatus ADVAPI32.dll::StartServiceW
WIN_TRUST_API	Uses Windows Trust API	WINTRUST.dll::WintrustGetRegPolicyFlags WINTRUST.dll::WinVerifyTrust

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample