MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5fe247828f3087cbede022c3db3c57ac8c0bb0138ea8e3424021afc4e314d076. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 20


Intelligence 20 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5fe247828f3087cbede022c3db3c57ac8c0bb0138ea8e3424021afc4e314d076
SHA3-384 hash: 1818dd4183d2704942a65ce78016f3264048cc10e49e771e85bfcc5af9a5cb2334ec9f3b720d1b33b6ce4c30e294c960
SHA1 hash: a736ed0ceb2cff740b9f1a6e7a0ce0efbf685fc5
MD5 hash: 351186b9b345b2fa94ab174c4c19b14f
humanhash: minnesota-virginia-oklahoma-hawaii
File name:SecuriteInfo.com.Win32.RATX-gen.7479.21659
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'236'488 bytes
First seen:2024-09-05 09:25:18 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'747 x AgentTesla, 19'633 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 24576:pUobyhBVHw9S2uk4zCbu26CKVHT38VqnlaV7pNI3xL35yd:iF9D2uk42bb1KVH78VqQbIt3y
Threatray 866 similar samples on MalwareBazaar
TLSH T12E4512C15298D9CAFD6D4372A4361DD84731AE6FC6B1F90C2C9AB4B657B3383220691F
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
File icon (PE):PE icon
dhash icon 13607332330b0bb3 (55 x AgentTesla, 16 x RedLineStealer, 13 x MassLogger)
Reporter SecuriteInfoCom
Tags:exe RemcosRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
372
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
remcos
Create hunting rule
ID:
1
File name:
SecuriteInfo.com.Win32.RATX-gen.7479.21659
Verdict:
Malicious activity
Analysis date:
2024-09-05 09:53:12 UTC
Tags:
rat remcos remote evasion stealer keylogger mpress
Link:
https://app.any.run/tasks/1f786111-357d-48cc-8dfc-1f2812c25a65

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Win32.RATX-gen.7479.21659.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=66d9792e8e12b8124ac94acf
Tags:
Discovery Encryption Execution Generic Infostealer Network Static Stealth Remcos
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Creating a process with a hidden window
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a file in the %temp% directory
Launching a process
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Setting a keyboard event handler
DNS request
Connection attempt
Sending a custom TCP request
Sending an HTTP GET request
Reading critical registry keys
Stealing user critical data
Adding an exclusion to Microsoft Defender
Enabling autorun by creating a file
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
overlay packed remcos vbnet
Link:
https://www.filescan.io/uploads/66d9792ba87cd1493c615651/reports/e3163478-b1c3-42e7-85b6-476e933cf6fb/overview
Verdict:
Malicious
Labled as:
Malware
Link:
https://www.hybrid-analysis.com/sample/5fe247828f3087cbede022c3db3c57ac8c0bb0138ea8e3424021afc4e314d076
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
REMCOS
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f2bbb375-f68e-4329-b7ea-973fed2a736b
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
rans.phis.troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1504735
Signature
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
AI detected suspicious sample
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to bypass UAC (CMSTPLUA)
Contains functionality to register a low level keyboard hook
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Contains functionalty to change the wallpaper
Delayed program exit found
Detected Remcos RAT
Found malware configuration
Injects a PE file into a foreign processes
Installs a global keyboard hook
Loading BitLocker PowerShell Module
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Remcos
Sigma detected: Scheduled temp file as task from temp location
Suricata IDS alerts for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file / registry access)
Tries to steal Mail credentials (via file registry)
Uses dynamic DNS services
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM3
Yara detected Remcos RAT
Yara detected UAC Bypass using CMSTP
Yara detected WebBrowserPassView password recovery tool
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1504735 Sample: SecuriteInfo.com.Win32.RATX... Startdate: 05/09/2024 Architecture: WINDOWS Score: 100 60 sungito2.ddns.net 2->60 62 geoplugin.net 2->62 76 Multi AV Scanner detection for domain / URL 2->76 78 Suricata IDS alerts for network traffic 2->78 80 Found malware configuration 2->80 84 14 other signatures 2->84 8 SecuriteInfo.com.Win32.RATX-gen.7479.21659.exe 7 2->8         started        12 dYDLGuPwXKp.exe 5 2->12         started        signatures3 82 Uses dynamic DNS services 60->82 process4 file5 50 C:\Users\user\AppData\...\dYDLGuPwXKp.exe, PE32 8->50 dropped 52 C:\Users\...\dYDLGuPwXKp.exe:Zone.Identifier, ASCII 8->52 dropped 54 C:\Users\user\AppData\Local\...\tmpF866.tmp, XML 8->54 dropped 56 SecuriteInfo.com.W....7479.21659.exe.log, ASCII 8->56 dropped 86 Tries to steal Mail credentials (via file registry) 8->86 88 Uses schtasks.exe or at.exe to add and modify task schedules 8->88 90 Adds a directory exclusion to Windows Defender 8->90 92 Injects a PE file into a foreign processes 8->92 14 SecuriteInfo.com.Win32.RATX-gen.7479.21659.exe 3 15 8->14         started        19 powershell.exe 23 8->19         started        21 powershell.exe 23 8->21         started        23 schtasks.exe 1 8->23         started        94 Contains functionality to bypass UAC (CMSTPLUA) 12->94 96 Contains functionalty to change the wallpaper 12->96 98 Machine Learning detection for dropped file 12->98 100 4 other signatures 12->100 25 dYDLGuPwXKp.exe 12->25         started        27 schtasks.exe 12->27         started        29 dYDLGuPwXKp.exe 12->29         started        signatures6 process7 dnsIp8 64 sungito2.ddns.net 154.216.19.222, 49735, 49736, 6509 SKHT-ASShenzhenKatherineHengTechnologyInformationCo Seychelles 14->64 66 geoplugin.net 178.237.33.50, 49737, 80 ATOM86-ASATOM86NL Netherlands 14->66 58 C:\ProgramData\remcos\logs.dat, data 14->58 dropped 68 Detected Remcos RAT 14->68 70 Maps a DLL or memory area into another process 14->70 72 Installs a global keyboard hook 14->72 31 SecuriteInfo.com.Win32.RATX-gen.7479.21659.exe 14->31         started        34 SecuriteInfo.com.Win32.RATX-gen.7479.21659.exe 14->34         started        36 SecuriteInfo.com.Win32.RATX-gen.7479.21659.exe 14->36         started        38 WMIADAP.exe 14->38         started        74 Loading BitLocker PowerShell Module 19->74 40 conhost.exe 19->40         started        42 WmiPrvSE.exe 19->42         started        44 conhost.exe 21->44         started        46 conhost.exe 23->46         started        48 conhost.exe 27->48         started        file9 signatures10 process11 signatures12 102 Tries to steal Instant Messenger accounts or passwords 31->102 104 Tries to steal Mail credentials (via file / registry access) 31->104 106 Tries to harvest and steal browser information (history, passwords, etc) 34->106
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/5fe247828f3087cbede022c3db3c57ac8c0bb0138ea8e3424021afc4e314d076
Detection:
remcos
Create hunting rule
Link:
https://mwdb.cert.pl/sample/5fe247828f3087cbede022c3db3c57ac8c0bb0138ea8e3424021afc4e314d076/
Threat name:
Win32.Backdoor.Remcos
Create hunting rule
Status:
Malicious
First seen:
2024-09-05 09:26:06 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
23 of 38 (60.53%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=l7repaupgcd4x3paelb5wpcxvsgaxmatr2uogqsaegx4jyyu2b3a._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
6cc066c3a33644d8a54496de97374b7a8804b490f7d3ca66c62c1bc6cb695fa5
RemcosRAT
7aedd5e4277e592d13cb250945dac96a7b4877de807904f7caa9d8ffb14963a5
RemcosRAT
86b19710e100964d95cfa01201152d4e73f1297f7286207feeb01cdb7e55efc8
RemcosRAT
95be57795b850e5aa098c80a107bafdb581da7653d9b57b8f2d37b89880de224
RemcosRAT
9b9ba6e3df79c2acd5ecdb46d3fb5f4828bcad17b899841fda48bef82f7ab1a1
RemcosRAT
b22f032935d1ecabe852ea8f41bc541c19367c380ba2f502b398f3fc8b775e82
RemcosRAT
b4952421150265489acc51c83234643237b1f06e468c450d604210e3ee50316e
RemcosRAT
d26670d5f425962b546d10ecd4d148f5884a3f392afe1c5fb4426466d4454c34
RemcosRAT
+ 856 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:sept 5 collection credential_access discovery execution rat spyware stealer
Link:
https://tria.ge/reports/240905-ld6y7sxckr/
Behaviour
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Accesses Microsoft Outlook accounts
Reads user/profile data of web browsers
Checks computer location settings
Command and Scripting Interpreter: PowerShell
Credentials from Password Stores: Credentials from Web Browsers
Detected Nirsoft tools
NirSoft MailPassView
NirSoft WebBrowserPassView
Remcos
Malware Config
C2 Extraction:
sungito2.ddns.net:6509
154.216.19.222:5532
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/1b8b0c0b-93e3-4ffb-89ae-da303e0ee72a
Unpacked files
SH256 hash:
150c6e7de31574a3dc8c09d743987ec2c43c9bd0e6aecbf91042722359e3adc0
MD5 hash:
48815524d9fe314ab98f8df0b182908f
SHA1 hash:
a0e4dded97841cded11dce2a1b84670be882f22c
Link:
https://www.unpac.me/results/6cd4c661-95d4-4c26-a0c4-dba1ae15f9b0/
SH256 hash:
6bc4fd10bbc084bb2759fd7aa5ac1b22ece10f9b5bbeeaef49add1ecf4f6783b
MD5 hash:
75e9a474738578d07a6269934443700f
SHA1 hash:
8d183cc9497c94bf7fb9d042c85d3cf36b7eeab3
Detections:
Remcos
Create hunting rule
win_remcos_auto
Create hunting rule
win_remcos_w0
Create hunting rule
malware_windows_remcos_rat
Create hunting rule
Link:
https://www.unpac.me/results/6cd4c661-95d4-4c26-a0c4-dba1ae15f9b0/
SH256 hash:
0e38f83e196b99f805e1bb7d70df13278a22351c88a34ec927e3403764d5315d
MD5 hash:
5f1213a49b40a33df8d27658719a434c
SHA1 hash:
85e80166ee8bc0ef36433e64c37c22c4bd540b18
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/6cd4c661-95d4-4c26-a0c4-dba1ae15f9b0/
SH256 hash:
5fe247828f3087cbede022c3db3c57ac8c0bb0138ea8e3424021afc4e314d076
MD5 hash:
351186b9b345b2fa94ab174c4c19b14f
SHA1 hash:
a736ed0ceb2cff740b9f1a6e7a0ce0efbf685fc5
Link:
https://www.unpac.me/results/6cd4c661-95d4-4c26-a0c4-dba1ae15f9b0/
Malware family:
Remcos
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/5fe247828f30/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5fe247828f3087cbede022c3db3c57ac8c0bb0138ea8e3424021afc4e314d076

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AgentTesla_DIFF_Common_Strings_01
Create hunting rule
Author:schmidtsz
Description:Identify partial Agent Tesla strings
Rule name:INDICATOR_KB_CERT_7c1118cbbadc95da3752c46e47a27438
Create hunting rule
Author:ditekSHen
Description:Detects executables signed with stolen, revoked or invalid certificates
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:pe_imphash
Create hunting rule
Rule name:PE_Potentially_Signed_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments