MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 63f039f6024860da44bd5522c38e55e7ab19cf47735d348c6046fd1bdacba6b2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 11


Intelligence 11 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 63f039f6024860da44bd5522c38e55e7ab19cf47735d348c6046fd1bdacba6b2
SHA3-384 hash: 8f44d1c8ac0edad28a5a47f00ecf940633d520c86b015487cb5ef96617ef4becafb51a85ac840837e27fc99cf76b8a29
SHA1 hash: 06f04274d7aa34db25c4e8c0b6c51dc7a4949034
MD5 hash: 5a6607442081b42f5c7b7cc5cbdcba01
humanhash: paris-kilo-paris-sierra
File name:63f039f6024860da44bd5522c38e55e7ab19cf47735d348c6046fd1bdacba6b2
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'372'909 bytes
First seen:2021-09-23 07:05:13 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash fcf1390e9ce472c7270447fc5c61a0c1 (863 x DCRat, 118 x NanoCore, 94 x njrat)
ssdeep 24576:rAOcZEhX2t6WbY4eRebUrtG331N2G4y/MSLhd5e1LmejVFQYcm0MnY6R:tYo8eRebka1e+hd5epmejV6G0wR
Threatray 1'592 similar samples on MalwareBazaar
TLSH T1D6552203BAD644B3E0732D321E269B51693DB4201F28EF6FB7940D6DE775581A234BB2
File icon (PE):PE icon
dhash icon a4a1b4ecd335ff5b (25 x NanoCore, 4 x AgentTesla, 2 x RemcosRAT)
Reporter JAMESWT_WT
Tags:exe RemcosRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
129
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
63f039f6024860da44bd5522c38e55e7ab19cf47735d348c6046fd1bdacba6b2
Verdict:
Malicious activity
Analysis date:
2021-09-23 07:28:11 UTC
Tags:
rat remcos autoit
Link:
https://app.any.run/tasks/fc007ee0-ab51-4f63-95ee-13b47f4c1fa2

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Remcos
Create hunting rule
Link:
https://www.capesandbox.com/analysis/190619/
Detection(s):
Win.Malware.Lisk-9875330-0
Create hunting rule

SecuriteInfo.com.Gen.Variant.Johnnie.221809.751.14920.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/594039e6-415c-421f-844c-2b58dbb890cc
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/856235
Signature
Allocates memory in foreign processes
Contains functionality to inject code into remote processes
Contains functionality to steal Firefox passwords or cookies
Delayed program exit found
Detected Remcos RAT
Drops PE files with a suspicious file extension
Injects a PE file into a foreign processes
Installs a global keyboard hook
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments
Writes to foreign memory regions
Yara detected AntiVM autoit script
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 488665 Sample: geqkE83hBJ Startdate: 23/09/2021 Architecture: WINDOWS Score: 100 34 mgc0147.hopto.org 2->34 40 Malicious sample detected (through community Yara rule) 2->40 42 Multi AV Scanner detection for submitted file 2->42 44 Detected Remcos RAT 2->44 46 3 other signatures 2->46 8 geqkE83hBJ.exe 36 2->8         started        12 memihp.pif 2->12         started        signatures3 process4 file5 30 C:\56529732\memihp.pif, PE32 8->30 dropped 56 Drops PE files with a suspicious file extension 8->56 14 memihp.pif 1 4 8->14         started        18 mshta.exe 12->18         started        signatures6 process7 file8 32 C:\Users\user\AppData\Local\...\RegSvcs.exe, PE32 14->32 dropped 58 Multi AV Scanner detection for dropped file 14->58 60 Writes to foreign memory regions 14->60 62 Allocates memory in foreign processes 14->62 64 Injects a PE file into a foreign processes 14->64 20 RegSvcs.exe 2 2 14->20         started        24 mshta.exe 14->24         started        26 mshta.exe 14->26         started        28 5 other processes 14->28 signatures9 process10 dnsIp11 36 mgc0147.hopto.org 194.5.98.158, 2930, 49779, 49780 DANILENKODE Netherlands 20->36 38 192.168.2.1 unknown unknown 20->38 48 Contains functionality to inject code into remote processes 20->48 50 Contains functionality to steal Firefox passwords or cookies 20->50 52 Installs a global keyboard hook 20->52 54 Delayed program exit found 20->54 signatures12
Detection:
remcos
Create hunting rule
Link:
https://mwdb.cert.pl/sample/63f039f6024860da44bd5522c38e55e7ab19cf47735d348c6046fd1bdacba6b2/
Threat name:
Win32.Trojan.Lisk
Create hunting rule
Status:
Malicious
First seen:
2021-09-19 00:55:13 UTC
AV detection:
23 of 44 (52.27%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mpydt5qcjbqnurf5kurmhdsv46vrtt2honotjddai36rxwwlu2za._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
1bda290016ee1740d9c160c85818d1859ff39402b8c412da2499703d6b5a5ccf
RemcosRAT
23570421eab96d998896192bff68e9ec54d2e97dc19bf62e26c856a3a668cb05
RemcosRAT
3afedea501a9bca64d1d400f5e3aa79e1f0d359a035d84569c123d49458425f2
RemcosRAT
64c32d82c0dd8612a93831055d36ba9b2767c213b2706212545fc80b34a4d900
RemcosRAT
a97278750b1c8339b6fc7601434b733174ec05d6bd5dbde44a2a98ca6951f183
RemcosRAT
c8c67b9895ec2b463cc43a5c9c1e32363ff1a7a061c99d01dd3de5691e9d1d47
RemcosRAT
caaed96b3aad8d2a3329b5088346af448509c2b2a2ead06af6fa3804fa9ef44b
RemcosRAT
ccca82e76f5e7fae5c3bcf6a5ff542f95ad241e2c47a00c969ddbf2f50beda25
RemcosRAT
e6930000e13aa3deafe16f78fcfca8e6276e18ba6a252b8045dfaf570f044328
RemcosRAT
+ 1'582 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:nanocore family:remcos botnet:september$$ keylogger persistence rat spyware stealer trojan
Link:
https://tria.ge/reports/210923-hw34gsabhp/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Loads dropped DLL
Executes dropped EXE
NanoCore
Remcos
Malware Config
C2 Extraction:
mgc0147.hopto.org:2930
Unpacked files
SH256 hash:
828df52ee5fea27d700c8493e206b64a7f459fc3cbcfb62f6028cc5c89b3213a
MD5 hash:
2ad574d4b8954344ca23297ecad67216
SHA1 hash:
eedde48c50c0ad284bb7b0065e0775b59b77f073
Detections:
win_remcos_g0
Create hunting rule
Link:
https://www.unpac.me/results/5717359a-9ba0-498b-ad83-a043644165b8/
SH256 hash:
cd4554720836f8b1a6c1ee5c99bb08bd7bc13c1e9bbfca9506d11db18a5f391d
MD5 hash:
171ae07e2221a7310b9157c13772c1bd
SHA1 hash:
5955cae62b125cf5efeb0481eea131103cff8f5a
Link:
https://www.unpac.me/results/5717359a-9ba0-498b-ad83-a043644165b8/
SH256 hash:
63f039f6024860da44bd5522c38e55e7ab19cf47735d348c6046fd1bdacba6b2
MD5 hash:
5a6607442081b42f5c7b7cc5cbdcba01
SHA1 hash:
06f04274d7aa34db25c4e8c0b6c51dc7a4949034
Link:
https://www.unpac.me/results/5717359a-9ba0-498b-ad83-a043644165b8/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/63f039f6024860da44bd5522c38e55e7ab19cf47735d348c6046fd1bdacba6b2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_RemcosRAT
Create hunting rule
Author:abuse.ch
Rule name:INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer
Create hunting rule
Author:ditekSHen
Description:detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Rule name:Remcos
Create hunting rule
Author:kevoreilly
Description:Remcos Payload
Rule name:remcos_rat
Create hunting rule
Author:jeFF0Falltrades

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/190619/

Comments