MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6213836adf0a16fd2de0edc90b326276d193728eea054dbb9127fe1ba8caa86e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 8


Intelligence 8 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6213836adf0a16fd2de0edc90b326276d193728eea054dbb9127fe1ba8caa86e
SHA3-384 hash: abd0779111b49a27c4f1ad362f13a101713e6037b08360df4432c569fc72ada831cb3f023213a8a5b2da6e10b3264595
SHA1 hash: c01e9948978ca69751692a3ac41b2873a3d864f2
MD5 hash: ea2664484d31d57447430eeab9256846
humanhash: oranges-shade-oregon-winter
File name:SecuriteInfo.com.W32.AIDetectNet.01.1464.1009
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:393'728 bytes
First seen:2022-07-15 15:02:37 UTC
Last seen:2024-07-24 15:03:56 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 6144:ViUqCVvMACNYOj3ZZIe7YOfxzQd1oTRmJ3eLCSiG:VYqQPCyxzdRmJOelG
Threatray 3'598 similar samples on MalwareBazaar
TLSH T11D843A0862D04D30CBBF07347A376A1DD2AC55A3656C1DA4F62E339B9FEAB012617F25
TrID 72.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.4% (.EXE) Win64 Executable (generic) (10523/12/4)
6.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.4% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter SecuriteInfoCom
Tags:exe RemcosRAT

Intelligence

File Origin
# of uploads :
2
# of downloads :
133
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/289735/
Detection(s):
SecuriteInfo.com.W32.AIDetectNet.01.1464.1009.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Сreating synchronization primitives
DNS request
Sending a custom TCP request
Sending an HTTP GET request
Launching a process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
75%
Tags:
packed
Link:
https://www.filescan.io/uploads/62d182b90b00dfa734f28371/reports/a06d4712-ac2b-403f-b67f-92d7795385cf/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
REMCOS
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/2249edc7-37b7-4675-8ff0-8f43289df004
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6213836adf0a16fd2de0edc90b326276d193728eea054dbb9127fe1ba8caa86e/
Threat name:
Win32.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2022-07-15 15:03:19 UTC
File Type:
PE (.Net Exe)
Extracted files:
16
AV detection:
15 of 26 (57.69%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mijyg2w7bilp2lpa5xeqwmtco3izg4uo5icu3o4re77bxkgkvbxa._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
21bd242ed07a92a9faef420a0b8bf377e83aaa9413ba4725da7f5c318182f7ec
RemcosRAT
2d6b7a5513ed0cb451701bb494fb87382061195c115ede553f062b4fc0fd4f97
RemcosRAT
58a7f521806093c7072a47070aeef1f69de6163b18eb9ada9541acb15957350b
RemcosRAT
6fe2d343fab2dc60337e0a6238649d04e6a9e74f54018a2e738abd5705e87ee6
RemcosRAT
a4b821d0cadc92c344c8b60f5290a5e5520fd1fb3813b88c529c48d285b72c63
RemcosRAT
b8fc4052fc07da469c7f33028796dceb6fb8daf1fe95d3c3c655217a8ecfdd64
RemcosRAT
c530ab34e439bbcaf995290504072a5f77ec085e2ef485e4ef324b7a957f5738
RemcosRAT
+ 3'588 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:remotehost rat suricata
Link:
https://tria.ge/reports/220715-sez1lsbeh2/
Behaviour
Modifies system certificate store
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Downloads MZ/PE file
Remcos
suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
Malware Config
C2 Extraction:
hendersonk1.hopto.org:2404
henderson1.camdvr.org:2404
centplus1.serveftp.com:2404
harrywlike.ddns.net:2404
genekol.nsupdate.info:2404
harrywlike1.ddns.net:2404
hendersonk2022.hopto.org:2404
genekol1.nsupdate.info:2404
generem.camdvr.org:2404
Unpacked files
SH256 hash:
919902a461d8f613a66b154ebd10d2a9fa7a19ba4e94bca664f90e3c04e2a785
MD5 hash:
3a27aad29127adb5024f5a5ba1b38525
SHA1 hash:
2701ea0d145821ecc72e4c44b58848226627833c
Link:
https://www.unpac.me/results/caa06cee-20be-4eb0-b7ed-6b6c788194be/
SH256 hash:
6213836adf0a16fd2de0edc90b326276d193728eea054dbb9127fe1ba8caa86e
MD5 hash:
ea2664484d31d57447430eeab9256846
SHA1 hash:
c01e9948978ca69751692a3ac41b2873a3d864f2
Link:
https://www.unpac.me/results/caa06cee-20be-4eb0-b7ed-6b6c788194be/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/6213836adf0a16fd2de0edc90b326276d193728eea054dbb9127fe1ba8caa86e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/289735/

Comments