MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5bb6c4fd0757c706f61538fac3e6697dc8ad2b1061682c079c2869dcba2ebc86. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	5bb6c4fd0757c706f61538fac3e6697dc8ad2b1061682c079c2869dcba2ebc86
SHA3-384 hash:	ef5c14cb787b3e646d323867fea119a94ce0d670b215dd14128aba3d13325349dfdd76c5493bf5724240550ed5cf2e1f
SHA1 hash:	4d02f999d7358a6b35ad669a81562b3c539e8ff2
MD5 hash:	2d853e7220ab376a753a07e0253045c4
humanhash:	finch-bacon-london-pip
File name:	PDF-OBLIGACION-4543663584-05-08-25-65785324.bat
Download:	download sample
Signature	RemcosRAT Alert Create hunting rule
File size:	13'673 bytes
First seen:	2024-08-12 12:45:56 UTC
Last seen:	2024-08-12 16:30:27 UTC
File type:	bat
MIME type:	text/x-msdos-batch
ssdeep	192:OrYGOE9mrcT/e0J5MP8eykyyxIWzHckBYbyKWpY/BimQ51qPKpg4uZLw17VYNvP4:qngizHJUVVq4qLoYkCum1PBkJ7
TLSH	T1D95262A5A3AA7FB12225E720D8A1FCD7D463489D3DFF8820A17C181ECF71349D868647
Reporter	smica83
Tags:	bat paialspailas-duckdns-org RemcosRAT

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

124

Origin country :

HU

Vendor Threat Intelligence

ANY.RUN remcos

Malware family:

remcos

Alert

Create hunting rule

ID:

1

File name:

PDF-OBLIGACION-4543663584-05-08-25-65785324.bat

Verdict:

Malicious activity

Analysis date:

2024-08-12 12:48:03 UTC

Tags:

stegocampaign loader opendir rat remcos remote evasion payload

Link:

https://app.any.run/tasks/b60b7bfa-0d3f-4fd4-8df9-cdaafa9e6213

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CyberFortress Malicious

Verdict:

Malicious

Score:

94.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=66ba040db35234d5cc65d416

Tags:

Discovery Encryption Execution Network Stealth

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Launching a process

Сreating synchronization primitives

DNS request

Connection attempt

Sending a custom TCP request

Connection attempt to an infection source

Creating a process with a hidden window

Using the Windows Management Instrumentation requests

Creating a file

Sending an HTTP GET request

Searching for the window

Query of malicious DNS domain

Sending a TCP request to an infection source

Setting a single autorun event

Launching a file downloaded from the Internet

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

anti-vm cmd find lolbin overlay powershell wmic

Link:

https://www.filescan.io/uploads/66ba040ccb4fdd04a35cb197/reports/ac3a40af-58a0-405a-9516-0fa50af69d18/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/5bb6c4fd0757c706f61538fac3e6697dc8ad2b1061682c079c2869dcba2ebc86

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Joe Sandbox Remcos

Result

Threat name:

Remcos

Alert

Create hunting rule

Detection:

malicious

Classification:

rans.spre.troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1491572

Signature

AI detected suspicious sample

Antivirus detection for URL or domain

Bypasses PowerShell execution policy

C2 URLs / IPs found in malware configuration

Contains functionality to steal Chrome passwords or cookies

Contains functionality to steal Firefox passwords or cookies

Contains functionalty to change the wallpaper

Creates autostart registry keys with suspicious values (likely registry only malware)

Delayed program exit found

Found malware configuration

Found suspicious powershell code related to unpacking or dynamic code loading

Injects a PE file into a foreign processes

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: Powershell download and load assembly

Sigma detected: Powershell download payload from hardcoded c2 list

Sigma detected: Powerup Write Hijack DLL

Suspicious execution chain found

Suspicious powershell command line found

Uses dynamic DNS services

Very long command line found

Writes to foreign memory regions

Yara detected Powershell download and execute

Yara detected Remcos RAT

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

3%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/5bb6c4fd0757c706f61538fac3e6697dc8ad2b1061682c079c2869dcba2ebc86

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5bb6c4fd0757c706f61538fac3e6697dc8ad2b1061682c079c2869dcba2ebc86/

ReversingLabs TitaniumCloud Win32.Trojan.Leonem

Threat name:

Win32.Trojan.Leonem

Alert

Create hunting rule

Status:

Malicious

First seen:

2024-08-09 00:20:43 UTC

File Type:

Text (Batch)

AV detection:

9 of 38 (23.68%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=lo3mj7ihk7dqn5qvhd5mhztjpxek2kyqmfucyb44fbu5zoroxsda._file

Threatray unknown

Verdict:

unknown

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

execution

Link:

https://tria.ge/reports/240812-pzmdgawbja/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Legitimate hosting services abused for malware hosting/C2

Blocklisted process makes network request

Command and Scripting Interpreter: PowerShell

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/5bb6c4fd0757c706f61538fac3e6697dc8ad2b1061682c079c2869dcba2ebc86