MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5b62ade8eb59bc5723c2db77bcfc25fdfd38905803912286afbf7d85ff1e73d5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemcosRAT

Vendor detections: 14

Intelligence 14 IOCs YARA 5 File information Comments 1

SHA256 hash:	5b62ade8eb59bc5723c2db77bcfc25fdfd38905803912286afbf7d85ff1e73d5
SHA3-384 hash:	c1b83141180cd377b5cee1f1b2eddf5268c415cd92872b29a6955aca4475ae1d5c31d65eb4220537cfeac45e33f02b58
SHA1 hash:	deadfee798ad5ad1fbb5f522d0dcbe404c34fc84
MD5 hash:	fc49267d06301ac812719a68dd3ee2c1
humanhash:	charlie-stream-eight-pip
File name:	fc49267d06301ac812719a68dd3ee2c1
Download:	download sample
Signature	RemcosRAT Create hunting rule
File size:	474'112 bytes
First seen:	2022-01-04 21:53:46 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	1f15bed3346039b42bc33c9080047f8c (26 x RemcosRAT)
ssdeep	12288:CegN0jfYLclGb0bVT6e+MT2MffZS/gVSYo:kNywLclGIeMT2MXZRVSV
TLSH	T165A49D11B9C1C032D17252700D29FB759AFCBC302935597BB3DA5D9ABE700C1BB2A6A7
File icon (PE):
dhash icon	c4d48eaa8ad4d4f8 (1'000 x RemcosRAT, 1 x Worm.Ramnit, 1 x Vjw0rm)
Reporter	zbetcheckin
Tags:	32 exe RemcosRAT

Intelligence

File Origin

# of uploads :

# of downloads :

214

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

fc49267d06301ac812719a68dd3ee2c1

Verdict:

Malicious activity

Analysis date:

2022-01-04 21:56:32 UTC

Tags:

rat remcos keylogger

Link:

https://app.any.run/tasks/c5a5d87f-551a-42b3-bd46-1c663ebc5a77

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Remcos

Link:

https://www.capesandbox.com/analysis/217325/

Detection(s):

Win.Trojan.Remcos-9753190-0

Win.Trojan.Remcos-9841897-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Сreating synchronization primitives

Setting a keyboard event handler

DNS request

Sending a custom TCP request

Creating a file in the %AppData% subdirectories

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

greyware keylogger remcos

Link:

https://www.filescan.io/uploads/61d4c1febfe53d318f266ec3/reports/725c2d9b-9cdd-422d-a7bc-ac5b320cb9a0/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

REMCOS

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/2deea007-3ad9-40db-aaa5-18cb59c5e33b

Result

Threat name:

Remcos

Detection:

malicious

Classification:

rans.troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/915509

Signature

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Contains functionality to steal Chrome passwords or cookies

Contains functionality to steal Firefox passwords or cookies

Contains functionalty to change the wallpaper

Delayed program exit found

Detected Remcos RAT

Found malware configuration

Installs a global keyboard hook

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Uses dynamic DNS services

Yara detected Remcos RAT

Behaviour

Behavior Graph:

Download SVG

Detection:

remcos

Link:

https://mwdb.cert.pl/sample/5b62ade8eb59bc5723c2db77bcfc25fdfd38905803912286afbf7d85ff1e73d5/

Threat name:

Win32.Trojan.Rescoms

Status:

Malicious

First seen:

2022-01-04 19:35:45 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

25 of 27 (92.59%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=lnrk32hllg6foi6c3n33z7bf7x6trecyaoisfbvpx56yl7y6opkq._file

Result

Malware family:

remcos

Score:

10/10

Tags:

family:remcos botnet:remotehost rat

Link:

https://tria.ge/reports/220104-1r7j8aheg5/

Behaviour

Suspicious use of SetWindowsHookEx

Remcos

Malware Config

C2 Extraction:

dynasty1.ddns.net:2404
dynasty2.ddns.net:2404
dynasty3.ddns.net:2404

Unpacked files

SH256 hash:

5b62ade8eb59bc5723c2db77bcfc25fdfd38905803912286afbf7d85ff1e73d5

MD5 hash:

fc49267d06301ac812719a68dd3ee2c1

SHA1 hash:

deadfee798ad5ad1fbb5f522d0dcbe404c34fc84

Detections:

win_remcos_g0

Link:

https://www.unpac.me/results/a2eb3cbe-6789-4f0f-bafb-039b42265aea/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Remcos

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/5b62ade8eb59bc5723c2db77bcfc25fdfd38905803912286afbf7d85ff1e73d5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_RemcosRAT Create hunting rule
Author:	abuse.ch

Rule name:	INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer Create hunting rule
Author:	ditekSHen
Description:	detects Windows exceutables potentially bypassing UAC using eventvwr.exe

Rule name:	Remcos Create hunting rule
Author:	kevoreilly
Description:	Remcos Payload

Rule name:	remcos_rat Create hunting rule
Author:	jeFF0Falltrades

Rule name:	REMCOS_RAT_variants Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RemcosRAT

exe 5b62ade8eb59bc5723c2db77bcfc25fdfd38905803912286afbf7d85ff1e73d5

(this sample)

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/1949549/

Cape

https://www.capesandbox.com/analysis/217325/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

zbet commented on 2022-01-04 21:53:48 UTC

url : hxxps://lumenhomes.ca/4.exe