MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 623bf7759de8303bc15901ee832dccb2febb294b84d3c5304022fb7be0b9c1f3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 14


Intelligence 14 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 623bf7759de8303bc15901ee832dccb2febb294b84d3c5304022fb7be0b9c1f3
SHA3-384 hash: a4a5b4353cf2d8a45657eb1906e18a9a96de1a7be0588901b9ad802f003a824c8a0d1e5e854d07ccbafa9f6a344b722d
SHA1 hash: 9244b408286c5e0cc4d5d10f5b0f6718756a66fe
MD5 hash: 962ac172fbb7edd2110cd1cfa61b782b
humanhash: orange-oregon-maryland-michigan
File name:623bf7759de8303bc15901ee832dccb2febb294b84d3c5304022fb7be0b9c1f3
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:468'992 bytes
First seen:2021-10-08 12:51:29 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash ec8ea73e2aa6f868311acc5b792bc222 (10 x RemcosRAT)
ssdeep 12288:4f+Ud9dFEvMNIWXLg4SPw5+rTmu/ZIzOEb:hUdyvMNDU25+r6YZve
Threatray 707 similar samples on MalwareBazaar
TLSH T12FA49D12B891C032C17212700D69FB759ABCBD202D3549BB73E96D5BFE710D1BB2A663
File icon (PE):PE icon
dhash icon c4d48eaa8ad4d4f8 (1'000 x RemcosRAT, 1 x Worm.Ramnit, 1 x Vjw0rm)
Reporter JAMESWT_WT
Tags:exe officialsw chickenkiller com RemcosRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
282
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
623bf7759de8303bc15901ee832dccb2febb294b84d3c5304022fb7be0b9c1f3
Verdict:
Malicious activity
Analysis date:
2021-10-08 13:11:13 UTC
Tags:
rat remcos keylogger
Link:
https://app.any.run/tasks/e4589a09-fd53-4626-8eb1-08398927df80

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Remcos
Create hunting rule
Link:
https://www.capesandbox.com/analysis/196163/
Detection(s):
Win.Trojan.Remcos-9753190-0
Create hunting rule

Win.Trojan.Remcos-9841897-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Setting a keyboard event handler
Creating a file in the %AppData% subdirectories
Connection attempt to an infection source
DNS request
Connection attempt
Query of malicious DNS domain
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/61603efae3d213d202bb95be/reports/c050825f-66c7-4acb-b707-6faeba9a5030/overview
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/867092
Signature
Antivirus / Scanner detection for submitted sample
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Delayed program exit found
Detected Remcos RAT
Found malware configuration
Installs a global keyboard hook
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Download SVG
Detection:
remcos
Create hunting rule
Link:
https://mwdb.cert.pl/sample/623bf7759de8303bc15901ee832dccb2febb294b84d3c5304022fb7be0b9c1f3/
Threat name:
Win32.Backdoor.Remcos
Create hunting rule
Status:
Malicious
First seen:
2021-09-30 19:44:32 UTC
AV detection:
26 of 28 (92.86%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mi57o5m55aydxqkzahxiglomwl7lwkklqtj4kmcael5xxyfzyhzq._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
5000f900d0d52fb1b6634d0437711ab10c9184d080c852f17b2fb114a35446a8
RemcosRAT
77ce24c903d75a340e3d5664091c7b72a2529640931e662b80b8dc3fb9226929
RemcosRAT
8378cff1c00e9259db81de361f9e5ebfc5eb1e932c0d21c5b003360c46a7eb43
RemcosRAT
860e16c192167d5dd823b8e533858cdada7aa9b3173254f2f57031af68b84e0c
RemcosRAT
87284733f84447db5f12697e7ce2fb44671cbf404e040cf85085b223eab02b95
RemcosRAT
993528adce97be31c6c1e1c01f4877f229b10e8f06b87d8cbcc2f95b46866872
RemcosRAT
a3faa214333ce59ed895410e011c4cbd44fe51b26ed5bf2a0ed54e225616f893
RemcosRAT
af9fa73ff6907f77d55aac6376f3f2e73160fc97afec3656e77da8d5e0a6a488
RemcosRAT
bfd45ef21e21655c921b457242c1d4e05a1e979d0051a4195192d8e17b7bed38
RemcosRAT
d83290b80bf412884168a6d24a06fad12edb578cc612ea555476b422a4499613
RemcosRAT
+ 697 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos rat
Link:
https://tria.ge/reports/211008-p343paedcr/
Behaviour
Suspicious use of SetWindowsHookEx
Remcos
Unpacked files
SH256 hash:
623bf7759de8303bc15901ee832dccb2febb294b84d3c5304022fb7be0b9c1f3
MD5 hash:
962ac172fbb7edd2110cd1cfa61b782b
SHA1 hash:
9244b408286c5e0cc4d5d10f5b0f6718756a66fe
Detections:
win_remcos_g0
Create hunting rule
Link:
https://www.unpac.me/results/1e06ec49-f123-4f48-a947-c89dda5a6f1d/
Malware family:
Remcos
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/623bf7759de8/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Remcos
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/623bf7759de8303bc15901ee832dccb2febb294b84d3c5304022fb7be0b9c1f3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_RemcosRAT
Create hunting rule
Author:abuse.ch
Rule name:INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer
Create hunting rule
Author:ditekSHen
Description:detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Rule name:Remcos
Create hunting rule
Author:kevoreilly
Description:Remcos Payload
Rule name:remcos_rat
Create hunting rule
Author:jeFF0Falltrades
Rule name:REMCOS_RAT_variants
Create hunting rule
Rule name:REMCOS_RAT_variants
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/196163/

Comments