MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5f6c5640c86a69d41538e7781c1dc06c577d126fb66abb8d6eed72513fabc2c9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemoteManipulator


Vendor detections: 14


Intelligence 14 IOCs 1 YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5f6c5640c86a69d41538e7781c1dc06c577d126fb66abb8d6eed72513fabc2c9
SHA3-384 hash: 6fbca5693c2f419e2fba2196d9285c77ba838a385293cd5a5f819c7819d8fa0ddfc56fdb2eefb860b20b7612baed6a5f
SHA1 hash: ae7fc9a0345e80ec36812ff6464d9ade1020315a
MD5 hash: f426b66b0ce498193c27bef3df1ed9cc
humanhash: edward-carbon-rugby-enemy
File name:5F6C5640C86A69D41538E7781C1DC06C577D126FB66AB.exe
Download: download sample
Signature RemoteManipulator
Create hunting rule
File size:14'326'272 bytes
First seen:2021-11-23 16:11:09 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash bd45e14ba33ab2dd0cc3f762de2b53d5 (1 x RemoteManipulator)
ssdeep 196608:S9w7I9aKULkWs55uyMlX+iFMAfD8toDV:Sx9aKULewyiXZfEoh
TLSH T119E6AF22B3C0643AD07A0A3A4C7BF764693F7A603B198C5B57E44A4C9FB53816E35787
File icon (PE):PE icon
dhash icon 9ea7e565e5a5a59a (1 x RemoteManipulator)
Reporter abuse_ch
Tags:exe RemoteManipulator


Avatar
abuse_ch
RemoteManipulator C2:
95.213.205.83:5655

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
95.213.205.83:5655 https://threatfox.abuse.ch/ioc/253280/

Intelligence

File Origin
# of uploads :
1
# of downloads :
201
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
5F6C5640C86A69D41538E7781C1DC06C577D126FB66AB.exe
Verdict:
Malicious activity
Analysis date:
2021-11-23 16:17:09 UTC
Tags:
installer
Link:
https://app.any.run/tasks/1f7237e7-74c7-48cc-8dbf-2d7dcaf9f450

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
PUA.Win.Packer.BorlandDelphi-15
Create hunting rule

PUA.Win.Packer.Exe-6
Create hunting rule

PUA.Win.Packer.WinrarSfx-1
Create hunting rule

Win.Trojan.RMS-9870689-1
Create hunting rule

ditekSHen.MALWARE.Win.Trojan.RemoteUtilitiesRAT.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a window
Creating a file
Searching for synchronization primitives
DNS request
Creating a process from a recently created file
Searching for the window
Running batch commands
Creating a process with a hidden window
Using the Windows Management Instrumentation requests
Launching a process
Creating a service
Launching a service
Sending an HTTP GET request
Connecting to a non-recommended domain
Sending a custom TCP request
Launching a tool to kill processes
Enabling autorun for a service
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
greyware keylogger packed packed
Link:
https://www.filescan.io/uploads/619d12d4b71ceed4152d301e/reports/5ceec078-3a6d-4bea-b6f1-17f811afe72b/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/3f43d95c-ebb3-4afa-9ed8-d4780842daf1
Result
Threat name:
RMSRemoteAdmin
Create hunting rule
Detection:
malicious
Classification:
evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/894914
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Contains functionality to detect sleep reduction / modifications
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses cmd line tools excessively to alter registry or file data
Uses regedit.exe to modify the Windows registry
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 527395 Sample: 5F6C5640C86A69D41538E7781C1... Startdate: 23/11/2021 Architecture: WINDOWS Score: 96 59 Antivirus detection for dropped file 2->59 61 Antivirus / Scanner detection for submitted sample 2->61 63 Multi AV Scanner detection for dropped file 2->63 65 4 other signatures 2->65 9 5F6C5640C86A69D41538E7781C1DC06C577D126FB66AB.exe 10 2->9         started        12 svchost.exe 9 1 2->12         started        15 svchost.exe 1 2->15         started        17 3 other processes 2->17 process3 dnsIp4 41 C:\WIN\System\start.exe, PE32 9->41 dropped 43 C:\WIN\System\rutserv.exe, PE32 9->43 dropped 45 C:\WIN\System\rfusclient.exe, PE32 9->45 dropped 47 2 other files (none is malicious) 9->47 dropped 19 start.exe 4 6 9->19         started        22 cmd.exe 1 9->22         started        51 127.0.0.1 unknown unknown 12->51 file5 process6 signatures7 67 Multi AV Scanner detection for dropped file 19->67 24 wscript.exe 1 19->24         started        69 Uses cmd line tools excessively to alter registry or file data 22->69 71 Uses regedit.exe to modify the Windows registry 22->71 27 conhost.exe 22->27         started        process8 dnsIp9 49 192.168.2.1 unknown unknown 24->49 29 cmd.exe 1 24->29         started        process10 signatures11 73 Uses cmd line tools excessively to alter registry or file data 29->73 32 rutserv.exe 29->32         started        35 taskkill.exe 1 29->35         started        37 taskkill.exe 1 29->37         started        39 8 other processes 29->39 process12 signatures13 53 Multi AV Scanner detection for dropped file 32->53 55 Machine Learning detection for dropped file 32->55 57 Contains functionality to detect sleep reduction / modifications 32->57
Detection:
azorult
Create hunting rule
Link:
https://mwdb.cert.pl/sample/5f6c5640c86a69d41538e7781c1dc06c577d126fb66abb8d6eed72513fabc2c9/
Threat name:
Win32.Trojan.Itagomoko
Create hunting rule
Status:
Malicious
First seen:
2018-07-02 03:49:11 UTC
File Type:
PE (Exe)
Extracted files:
285
AV detection:
24 of 28 (85.71%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=l5wfmqginju5ifjy454byhoanrlx2etpwzvlxdlo5vzfcp5lyleq._file
Verdict:
malicious
Result
Malware family:
rms
Create hunting rule
Score:
  10/10
Tags:
family:rms evasion rat trojan
Link:
https://tria.ge/reports/211123-tnhy5aafcq/
Behaviour
Delays execution with timeout.exe
Kills process with taskkill
Modifies registry class
Runs .reg file with regedit
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: SetClipboardViewer
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Views/modifies file attributes
Enumerates physical storage devices
Drops file in Program Files directory
Deletes itself
Loads dropped DLL
Executes dropped EXE
Sets file to hidden
RMS
Unpacked files
SH256 hash:
5f6c5640c86a69d41538e7781c1dc06c577d126fb66abb8d6eed72513fabc2c9
MD5 hash:
f426b66b0ce498193c27bef3df1ed9cc
SHA1 hash:
ae7fc9a0345e80ec36812ff6464d9ade1020315a
Detections:
win_rms_a0
Create hunting rule
win_rms_auto
Create hunting rule
Link:
https://www.unpac.me/results/89740780-d7b8-4e2b-9e12-b234f35ca8ee/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5f6c5640c86a69d41538e7781c1dc06c577d126fb66abb8d6eed72513fabc2c9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:MALWARE_Win_RemoteUtilitiesRAT
Create hunting rule
Author:ditekSHen
Description:RemoteUtilitiesRAT RAT payload
Rule name:win_rms_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments