MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6984fbcdc07aa5d975b4f6742888e3185d6091440b0b76bce13ca81d2a7f931e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemoteManipulator


Vendor detections: 6


Intelligence 6 IOCs 1 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6984fbcdc07aa5d975b4f6742888e3185d6091440b0b76bce13ca81d2a7f931e
SHA3-384 hash: 0477cd1338d5db8a914e0b3d6b2e21d5fab8bcf78d71e195726160a7566e8228e04cac9cd6dbc693139c7e365aaeacb9
SHA1 hash: 00c1eed0f221fd5b1b4969718474876a253abb18
MD5 hash: c1449224fe94853d6ffe4665a33ff285
humanhash: butter-blue-carpet-pizza
File name:C1449224FE94853D6FFE4665A33FF285.exe
Download: download sample
Signature RemoteManipulator
Create hunting rule
File size:18'245'632 bytes
First seen:2021-07-23 20:45:56 UTC
Last seen:2021-07-23 21:43:30 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 19b321cb7a9ce31c90397152f38b67ea (29 x RemoteManipulator)
ssdeep 393216:VwupmK/0AI3mIiQFWs2/HUie2SwnJu7AihlWuZ2HYHYCQQaK0P:VwuzTI3t72/HvdS6QAWlhYrQaF
Threatray 38 similar samples on MalwareBazaar
TLSH T1690733C2E7F04409FCFF027299F69F0C1A2AFDAC9B66630A09D4F25974639520D662D7
dhash icon c0dacabacac0c244 (20 x RemoteManipulator)
Reporter abuse_ch
Tags:exe RemoteManipulator


Avatar
abuse_ch
RemoteManipulator C2:
65.0.5.240:5655

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
65.0.5.240:5655 https://threatfox.abuse.ch/ioc/162579/

Intelligence

File Origin
# of uploads :
2
# of downloads :
171
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
C1449224FE94853D6FFE4665A33FF285.exe
Verdict:
No threats detected
Analysis date:
2021-07-23 20:47:01 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/74206782-3d20-419d-aeab-1c8e5bca7b94

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
PUA.Win.Packer.Upolyx-12
Create hunting rule

PUA.Win.Packer.Upx-4
Create hunting rule

PUA.Win.Packer.Exe-6
Create hunting rule

PUA.Win.Tool.RemoteUtilities-9869515-0
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
RMSRemoteAdmin Remote Utilities
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/821065
Signature
Changes security center settings (notifications, updates, antivirus, firewall)
Detected Remote Utilities RAT
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 453476 Sample: bzkYTTYjxN.exe Startdate: 23/07/2021 Architecture: WINDOWS Score: 64 39 Multi AV Scanner detection for submitted file 2->39 41 Detected Remote Utilities RAT 2->41 43 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 2->43 7 rutserv.exe 7 4 2->7         started        11 svchost.exe 2->11         started        13 bzkYTTYjxN.exe 5 2->13         started        16 15 other processes 2->16 process3 dnsIp4 33 65.0.5.240, 49738, 5655 AMAZON-02US United States 7->33 47 Detected Remote Utilities RAT 7->47 18 rfusclient.exe 7->18         started        21 rfusclient.exe 7->21         started        49 Changes security center settings (notifications, updates, antivirus, firewall) 11->49 23 MpCmdRun.exe 11->23         started        31 C:\Users\user\...\host6.12.b1_unsigned.msi, Intel;1033 13->31 dropped 25 msiexec.exe 13->25         started        35 127.0.0.1 unknown unknown 16->35 37 192.168.2.1 unknown unknown 16->37 file5 signatures6 process7 signatures8 45 Detected Remote Utilities RAT 18->45 27 rfusclient.exe 18->27         started        29 conhost.exe 23->29         started        process9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6984fbcdc07aa5d975b4f6742888e3185d6091440b0b76bce13ca81d2a7f931e/
Threat name:
Win32.Trojan.RemoteUtilities
Create hunting rule
Status:
Malicious
First seen:
2021-07-20 17:47:28 UTC
AV detection:
11 of 28 (39.29%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ngcpxtoapks5s5nu6z2crchddbowbekebmfxnphbhsub2kt7smpa._file
Verdict:
malicious
Similar samples:
049f386b48f72d13008397a7421a63ee16b65ad432263c9ee59b1a13521d9609
RemoteManipulator
4de20c5375b9f484f3c764bc62721329813692e6441060fa1674ecec0f13584b
RemoteManipulator
5312214b15330113f6eab71565e1e3c7d1ee3b59daa6703c271aaf3b192e6809
RemoteManipulator
6c8a5f43e07034d0545c60c137f96c6ab8da44cfd59a8654896c8f6c497aefad
RemoteManipulator
7cebce024d5351e0179898fffce2628756bdcd33f9ce3833f922f1265b6e5f73
RemoteManipulator
8f4d63fea00eca6d91147de6a10b7aae6069f164ef00d5986eff571249552dae
RemoteManipulator
8fba783fb93013344dd2182721a3b1a3fbc96b7b8c49ad4b364c63a0f2b11496
RemoteManipulator
a5f7b339a431830ce2cc5826dd2ed3099497089277397beb6e425e5e15935e63
RemoteManipulator
c8ebec4136a41a11aa96976ce1b5d4b01785ff3ac94b781550cc2e11984c7a2c
RemoteManipulator
ed20ff85f5df587140e0780e16a5eb28df94e1b6330c8256de39d94b5a772e83
RemoteManipulator
+ 28 additional samples on MalwareBazaar
Result
Malware family:
rurat
Create hunting rule
Score:
  10/10
Tags:
family:rurat backdoor discovery trojan upx
Link:
https://tria.ge/reports/210723-vzg5kekd7n/
Behaviour
Modifies data under HKEY_USERS
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: SetClipboardViewer
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Program Files directory
Drops file in Windows directory
Checks installed software on the system
Enumerates connected drives
Checks computer location settings
Loads dropped DLL
Blocklisted process makes network request
Executes dropped EXE
RuRAT
Unpacked files
SH256 hash:
040752d18f978a437684d118f6ca5322c51b956f8911b32307db1fd4559a916c
MD5 hash:
3c545c5efb38a7291c3ba25d189df717
SHA1 hash:
70a1640096b9c8842fa58777fa0c9d407db602f8
Link:
https://www.unpac.me/results/72f1eff7-a644-4bac-a67a-1c4be7aaf277/
SH256 hash:
6984fbcdc07aa5d975b4f6742888e3185d6091440b0b76bce13ca81d2a7f931e
MD5 hash:
c1449224fe94853d6ffe4665a33ff285
SHA1 hash:
00c1eed0f221fd5b1b4969718474876a253abb18
Link:
https://www.unpac.me/results/72f1eff7-a644-4bac-a67a-1c4be7aaf277/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.33
Link:
https://yomi.yoroi.company/submissions/6984fbcdc07aa5d975b4f6742888e3185d6091440b0b76bce13ca81d2a7f931e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments