MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 57bbdab22d9197c60e2bb9aa35a36321276518c07716a71a0c7005944473a03d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 9


Intelligence 9 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 57bbdab22d9197c60e2bb9aa35a36321276518c07716a71a0c7005944473a03d
SHA3-384 hash: bf4a3b2451096e9226f13b17d5673f6ff8be7d9ea710b8086113e5f71d45245835fa954897b8d8ba4c70065224c4583f
SHA1 hash: 9755298b65c91d293db0228b060177cf79174917
MD5 hash: dfc5e29b152ae0a4eae88a224d08cc8d
humanhash: jersey-twelve-fish-five
File name:Administrative Penalty Statement of Account _6636363737469938.exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'295'872 bytes
First seen:2021-05-25 12:48:41 UTC
Last seen:2021-05-25 13:01:41 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'603 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 24576:Ps8wHHb+dwny251URiJzhsaSGPhDp/UAH:Pstb+Cy2HUYJiNKfsAH
Threatray 226 similar samples on MalwareBazaar
TLSH B5557C2CB859F519E17CC2B905E472E7E850CB332433AE94AAE327C8D2BDD417C9916D
Reporter abuse_ch
Tags:exe RemcosRAT

Intelligence

File Origin
# of uploads :
2
# of downloads :
124
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Administrative Penalty Statement of Account _6636363737469938.exe
Verdict:
Malicious activity
Analysis date:
2021-05-25 12:54:05 UTC
Tags:
rat remcos
Link:
https://app.any.run/tasks/fc081c57-b9a8-42c5-ab7a-a3ab16e90a89

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/161907/
Detection(s):
SecuriteInfo.com.Malware.AI.2403559538.26814.20630.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Sending a UDP request
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/791654
Signature
.NET source code contains very large strings
Adds a directory exclusion to Windows Defender
C2 URLs / IPs found in malware configuration
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Contains functionality to inject code into remote processes
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Delayed program exit found
Detected Remcos RAT
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sigma detected: WScript or CScript Dropper
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM3
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 424065 Sample: Administrative Penalty Stat... Startdate: 25/05/2021 Architecture: WINDOWS Score: 100 75 Found malware configuration 2->75 77 Malicious sample detected (through community Yara rule) 2->77 79 Multi AV Scanner detection for submitted file 2->79 81 16 other signatures 2->81 9 Administrative Penalty Statement of Account _6636363737469938.exe 7 2->9         started        13 remcos.exe 2->13         started        15 remcos.exe 2->15         started        process3 file4 65 C:\Users\user\AppData\Roaming\QibXCPQN.exe, PE32 9->65 dropped 67 C:\Users\...\QibXCPQN.exe:Zone.Identifier, ASCII 9->67 dropped 69 C:\Users\user\AppData\Local\Temp\tmp7E8.tmp, XML 9->69 dropped 71 Administrative Pen...63737469938.exe.log, ASCII 9->71 dropped 89 Adds a directory exclusion to Windows Defender 9->89 91 Injects a PE file into a foreign processes 9->91 17 Administrative Penalty Statement of Account _6636363737469938.exe 9->17         started        20 powershell.exe 20 9->20         started        22 powershell.exe 25 9->22         started        34 2 other processes 9->34 24 powershell.exe 13->24         started        27 powershell.exe 13->27         started        29 remcos.exe 13->29         started        32 schtasks.exe 13->32         started        signatures5 process6 dnsIp7 59 C:\Users\user\AppData\Roaming\...\remcos.exe, PE32 17->59 dropped 61 C:\Users\user\...\remcos.exe:Zone.Identifier, ASCII 17->61 dropped 63 C:\Users\user\AppData\Local\...\install.vbs, data 17->63 dropped 36 wscript.exe 17->36         started        38 conhost.exe 20->38         started        40 conhost.exe 22->40         started        87 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 24->87 42 conhost.exe 24->42         started        44 conhost.exe 27->44         started        73 216.38.7.225, 49728, 6524 ASN-GIGENETUS United States 29->73 46 conhost.exe 32->46         started        48 conhost.exe 34->48         started        50 conhost.exe 34->50         started        file8 signatures9 process10 process11 52 cmd.exe 36->52         started        process12 54 remcos.exe 52->54         started        57 conhost.exe 52->57         started        signatures13 83 Machine Learning detection for dropped file 54->83 85 Adds a directory exclusion to Windows Defender 54->85
Detection:
remcos
Create hunting rule
Link:
https://mwdb.cert.pl/sample/57bbdab22d9197c60e2bb9aa35a36321276518c07716a71a0c7005944473a03d/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-05-25 12:49:06 UTC
File Type:
PE (.Net Exe)
Extracted files:
29
AV detection:
21 of 47 (44.68%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=k655vmrnsgl4mdrlxgvdli3deetwkggao4lkogqmoaczirdtua6q._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
30552657a06df54de322d5d689ca77d2cacbf8e85136ca915843c9a99e4f26c0
RemcosRAT
481d9a1417683843ff3bf8936227f69dbb80cad91b0c408bf30a99f889c09659
RemcosRAT
4969dc5e2b7349e189cdc079c2e9e02014e559d1315564b6d6fd18eeb252c605
RemcosRAT
8017cf230cb7f4e72b6128a7e696821749c4990dbd446f8206d948c3ed6530ec
RemcosRAT
8c3a6d5b05325958afeb7885e7d4bbe59f7f5a849b5acdf0a8f7cbb8febc4a81
RemcosRAT
a0bb5a244b144a8e10087fd70a04580c3bb8c4c8add7da671a06f10020473004
RemcosRAT
af0249150bee4fec74c124f89019cd260c9aacd7b7a7715192b5097f1948eb82
RemcosRAT
bba34099de8e5e947f218de51e0f490f07ec6063bc22c39cf375785528cb3f90
RemcosRAT
c85d33153d768a2f98066c8ba07e58890cbac4c185e4ef45739fb03750e1088b
RemcosRAT
f0896ba259cc40a67474db857cbca2cd43099f5b49be45c3e3a3a34a06765b7f
RemcosRAT
+ 216 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos persistence rat
Link:
https://tria.ge/reports/210525-hs7zkewa92/
Behaviour
Creates scheduled task(s)
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Loads dropped DLL
Executes dropped EXE
Remcos
Malware Config
C2 Extraction:
216.38.7.225:6524
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/57bbdab22d9197c60e2bb9aa35a36321276518c07716a71a0c7005944473a03d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

Executable exe 57bbdab22d9197c60e2bb9aa35a36321276518c07716a71a0c7005944473a03d

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/161907/

Comments