MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 571776f9f0168eb83034055ce51c1c72d1dcc6cb10445ac4de70104f97a170ff. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 15


Intelligence 15 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 571776f9f0168eb83034055ce51c1c72d1dcc6cb10445ac4de70104f97a170ff
SHA3-384 hash: 2f379be374cc7c2da2dc8c6d765e0f079f0884e96e128ca18bb13f5bcb861e50558f9969a9515e2b6ad53b06064d1505
SHA1 hash: 67e99b621351bc0cbd410bcd9b5447d7703c2f79
MD5 hash: a3d6c24e2b3f8b74a345133aba1faf2d
humanhash: carbon-skylark-skylark-fix
File name:docs-070422.exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'079'808 bytes
First seen:2022-04-07 16:35:33 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 4116ae7b3160bb7c72cca76cb8e5eb22 (5 x Formbook, 5 x DBatLoader, 3 x ModiLoader)
ssdeep 12288:33NcL6BFE+1exrI13sasf0iLBBejqqB7WLjq716TnT0tyB3h2NZec4qOjF:3aj4eisasTBorATnT00WNby
TLSH T118358D12FB586833C8321A395D0FA7A45936BE037D24441A2BE16D5CEFF73427939693
File icon (PE):PE icon
dhash icon b2b1f1ecccce9c98 (8 x Formbook, 6 x DBatLoader, 5 x ModiLoader)
Reporter TeamDreier
Tags:exe RemcosRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
305
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
remcos
Create hunting rule
ID:
1
File name:
Xksupai.exe
Verdict:
Malicious activity
Analysis date:
2022-04-07 10:49:56 UTC
Tags:
keylogger remcos
Link:
https://app.any.run/tasks/155b37b2-7094-470c-bd97-e8409be7cdac

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/261764/
Detection(s):
Win.Trojan.Pwsx-9943091-0
Create hunting rule

SecuriteInfo.com.W32.AIDetect.malware2.28889.30456.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a window
DNS request
Sending a custom TCP request
Sending an HTTP GET request
Creating a file
Running batch commands
Creating a process with a hidden window
Launching cmd.exe command interpreter
Launching the process to interact with network services
Launching a process
Using the Windows Management Instrumentation requests
Creating a file in the %AppData% subdirectories
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a system process
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/13015/overview
Behaviour
MalwareBazaar
CheckCmdLine
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
control.exe greyware keylogger packed replace.exe
Link:
https://www.filescan.io/uploads/624f12f7d53a7479dad0664f/reports/d41198a7-2bae-45c4-8c7e-222561422769/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
REMCOS
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/a034e590-18b4-4682-b19c-5c070ddf0912
Result
Threat name:
DBatLoader Remcos
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/972615
Signature
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Creates a thread in another existing process (thread injection)
Delayed program exit found
Found malware configuration
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Suspicious Program Location with Network Connections
Writes to foreign memory regions
Yara detected DBatLoader
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 605109 Sample: docs-070422.exe Startdate: 07/04/2022 Architecture: WINDOWS Score: 100 36 style.ptbagasps.co.id 2->36 56 Multi AV Scanner detection for domain / URL 2->56 58 Found malware configuration 2->58 60 Malicious sample detected (through community Yara rule) 2->60 62 6 other signatures 2->62 9 Xksupai.exe 15 2->9         started        13 Xksupai.exe 15 2->13         started        15 docs-070422.exe 1 20 2->15         started        signatures3 process4 dnsIp5 42 l-0004.l-dc-msedge.net 13.107.43.13, 443, 49777, 49779 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 9->42 44 sn-files.fe.1drv.com 9->44 50 2 other IPs or domains 9->50 70 Multi AV Scanner detection for dropped file 9->70 72 Writes to foreign memory regions 9->72 74 Allocates memory in foreign processes 9->74 18 DpiScaling.exe 2 2 9->18         started        46 l-0003.l-dc-msedge.net 13.107.43.12, 443, 49784, 49786 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 13->46 52 3 other IPs or domains 13->52 76 Creates a thread in another existing process (thread injection) 13->76 78 Injects a PE file into a foreign processes 13->78 22 logagent.exe 13->22         started        48 sn-files.fe.1drv.com 15->48 54 2 other IPs or domains 15->54 34 C:\Users\Public\Libraries\Xksupai.exe, PE32 15->34 dropped 24 cmd.exe 1 15->24         started        26 logagent.exe 15->26         started        file6 signatures7 process8 dnsIp9 38 style.ptbagasps.co.id 185.62.86.145, 42024 THINKSYSTEMSUK-ASNGB United Kingdom 18->38 40 192.168.2.1 unknown unknown 18->40 64 Contains functionality to steal Chrome passwords or cookies 18->64 66 Contains functionality to steal Firefox passwords or cookies 18->66 68 Delayed program exit found 18->68 28 cmd.exe 1 24->28         started        30 conhost.exe 24->30         started        signatures10 process11 process12 32 conhost.exe 28->32         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/571776f9f0168eb83034055ce51c1c72d1dcc6cb10445ac4de70104f97a170ff/
Threat name:
Win32.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2022-04-07 08:47:16 UTC
File Type:
PE (Exe)
Extracted files:
43
AV detection:
16 of 26 (61.54%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=k4lxn6pqc2hlqmbuavookha4oli5zrwlcbcfvrg6oaie7f5bod7q._file
Verdict:
malicious
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:modiloader family:remcos botnet:nifty persistence rat trojan
Link:
https://tria.ge/reports/220407-t38hbsfgbk/
Behaviour
Modifies data under HKEY_USERS
Runs net.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Adds Run key to start application
ModiLoader, DBatLoader
Remcos
Malware Config
C2 Extraction:
style.ptbagasps.co.id:42024
Unpacked files
SH256 hash:
4f921407dc157cd3ec27cf0bfb6bba1e1b5463076526378fa65e8121288a774b
MD5 hash:
f125d9101ccc3b42b5a847f8182b85e5
SHA1 hash:
c2f18fe8876110488df97d0818e0dd3cb89b0105
Detections:
win_dbatloader_w0
Create hunting rule
Link:
https://www.unpac.me/results/2b944ea3-3878-4d81-98d9-3560cc14bf55/
Parent samples :
3e25c1a249031c7ec06d4d6ad15a9dcd9f6cf0a72053663ebdd7a31eafb59c35
710c03f2e039d3bde583d2fa87faa58d17cbe6655a31b1e4e7890bf9687952c5
3bdc8a2cdae7fb2ab12ead1f0ced298aefb6cdcd9d35e88295a71192e193d481
805d05e4bc4ea60742052443cb9e2a4b3527aee8f311862ed37ec98559884555
571776f9f0168eb83034055ce51c1c72d1dcc6cb10445ac4de70104f97a170ff
2bc652d367cd94c0eb550959e49567754d73f8eb19a485cc229ffe4caab5605d
afb058fdd8aa200fe754289c9b48d8876f4bbd7cbcefc964742d76c32a990340
7ac202314f674281f31bad6e38a61c4bdd54c07f14b6dfd260d0665b8f2d0fa5
4690e84717b8b884bec65eddf700c6c99cfd19ebacbeadd766f9c3088c291112
03632b99b5401681e8dacf45710bfce9919f840843b836bad53c3113dacb097e
7cb6095dfefda254e0f96c3613cddcbcff7ce50b57a78e7f369d846d222eef49
82fc93baeea70f5e1c60ea976212b5cd2a33402ede66cd0efb059eaa5fae8150
b931f34008a112398ad48f0bd4e2e955dd7385bcc5cafd41cdb2220f26bddc44
6353828ddb8f70dd9a535d3314ac328b044539563334f093173b86fd96e24707
687b7b359a5cac51eeb2d8bd04b147bdca3af96f148c2e560b3aff235d48e6b0
bea87dfd8f3d79c5948163bb57da34a9c86b798817c9e5b9c8f169175b3f2a33
27309bb8844a4d48af2527787b781fdac2917d6f75f870743428a3e7aa44fc1a
fcc249e21fb278d56fcc3758f3b5f3730420688791b2195255ae8e6cc4bc5334
a421a1405a23a9e8e3807cee8c264a3068171e19f01f3d00e318a1757024db18
ee0e3ef0d4e024fee83ad9744a0c2fda54ea009c099144d7f3f5972b0e3c7c4d
4f921407dc157cd3ec27cf0bfb6bba1e1b5463076526378fa65e8121288a774b
70784bb09d094929ecd5666ae8d5ee613c7dbee18a21b009595f0b19777f5ec5
3f402617d9bbe740d49a4c0e0b17e4c704a11f04ad5c708a08c5a6988e7c181f
c122639d652908b10751cb546a1c48e753427aa4d74f6a638fcb6c829b65e12f
5a66917ff5fd5809f0c83a8240aeb983799f54916c0f45d2f1af61de5b7741f1
ac749d4dc15be0711d85256e946a41958427a7468dc3e15f0069d3691364c45a
c130e105a03b4d144a63a8be13f6c84aa4bb01df2a566756e022e79bec487c20
6a52acf5de13a2c4d6fa927727fb868db6d97220c5eb837ca307d19c0b7cf128
9ef6b1868ca09cf927398496746dc5c1e73980fe7e3c1ffe4f45004a1f11d16b
75b7d30e6f26fbb3fbac284ed75356cc874e73365764130209d4937d80a6c80d
08c0273e2bd04a047d150303d4cd05076c2d2877afa82543ce43fc8296d86a7c
dcccbb97201914164dc8bed003f14daadfa300a6206b7ce835f6c7ee8b686405
3e755ebc4b3e451616df6473cf0f804e3c0d79e06e4f7bd54f94544848961f12
d228e18c458c31492267b3167e1bde3b8702de493ea612d0ecf400835f490982
6097ee7a7f386804b11c435db24b34c3e54bb26b4cb4569c6c8c06f471513c73
c97ea7770bdc793b6e4f5ecdd0ab4454b51475faebb2368f338f620b353a0db1
6db572b2a372da55a29c00656ffdc03d279b01a57eaf854f58441847d3915ebc
9ea23f24620fd64243f22df105d30b97810377238aed2fd83aa31665198175db
26b24f28b0173c020071085d65b260207d5856a8a93c1c1acce7d5cca5e8835f
101159b2df3d82639b34a56f1b72524504492b91c80543689484a6e4ead0848c
a51e73ec5bca72dcebd78f128e76fa4bcb942ee0509d9c549e721806301a3e13
5be80161a65053eed5a2e9f84fd3c28eed3b40df540614ac86b56f6c5a3a5233
c27f65a625e611d0d29febe606a4e48421b30085f1536fe18fa8d41e665ccced
240970ef6292a02db1cd7c6fec1aa55036b11a20a3bed21318a056f9063e5088
SH256 hash:
47b0808dc672bdab43262faac9ee31d26f18ecd0527419ee9a8ded53e508e2b9
MD5 hash:
6339f06b4dea9250f8009b63ddee95e6
SHA1 hash:
b010c6e985916d5b1c4148870a7093ad324e06ff
Link:
https://www.unpac.me/results/2b944ea3-3878-4d81-98d9-3560cc14bf55/
SH256 hash:
571776f9f0168eb83034055ce51c1c72d1dcc6cb10445ac4de70104f97a170ff
MD5 hash:
a3d6c24e2b3f8b74a345133aba1faf2d
SHA1 hash:
67e99b621351bc0cbd410bcd9b5447d7703c2f79
Link:
https://www.unpac.me/results/2b944ea3-3878-4d81-98d9-3560cc14bf55/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/571776f9f016/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/571776f9f0168eb83034055ce51c1c72d1dcc6cb10445ac4de70104f97a170ff

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

Executable exe 571776f9f0168eb83034055ce51c1c72d1dcc6cb10445ac4de70104f97a170ff

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/261764/

Comments