MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6a182d41a2d215552343174e699a7dba2d6282136f338a88826ac5eac8f0e7f6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 13


Intelligence 13 IOCs 1 YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6a182d41a2d215552343174e699a7dba2d6282136f338a88826ac5eac8f0e7f6
SHA3-384 hash: 7b16f0cc8db7ef907a18ed312fb85c5eda0db4e0688ec5c630f83308ca4b235c0c8935dcb9ee7265d3b1de4219e8602a
SHA1 hash: 256e1af8f4650520b1cf41f00e449b6e85510daa
MD5 hash: efb024da581e627180972c9f742daff4
humanhash: cup-august-magnesium-video
File name:efb024da581e627180972c9f742daff4.exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'329'776 bytes
First seen:2022-03-13 15:05:29 UTC
Last seen:2022-03-13 16:48:04 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 24576:nvSSf8ccI7+Ml36R1Inurl6X4x66z649Fl9WT9PYVdMrSXYlNHn0:nvb7jl36V6X4x66m49f4T9wbMrSXYY
Threatray 3'005 similar samples on MalwareBazaar
TLSH T16B55CF109E560836F57E6A7617C4A82349E7AD623518E2BE1C3CF6590FF2EBD9C80C71
File icon (PE):PE icon
dhash icon 000f272b0b270e00 (2 x RemcosRAT)
Reporter abuse_ch
Tags:exe RAT RemcosRAT


Avatar
abuse_ch
RemcosRAT C2:
194.31.98.93:22301

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
194.31.98.93:22301 https://threatfox.abuse.ch/ioc/394938/

Intelligence

File Origin
# of uploads :
2
# of downloads :
249
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/249876/
Detection(s):
SecuriteInfo.com.Trojan.Inject4.27826.15799.14899.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a process from a recently created file
Creating a process with a hidden window
Launching a process
Launching cmd.exe command interpreter
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm obfuscated overlay packed replace.exe
Link:
https://www.filescan.io/uploads/622e085eb94fb38cb4716cf3/reports/655dd353-91df-4f6b-b10b-86a71bd7bf3f/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/28bc0f82-e0d4-4908-817c-712e6b5d6148
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/955597
Signature
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
Allocates memory in foreign processes
Contains functionality to inject code into remote processes
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Delayed program exit found
Detected unpacking (creates a PE file in dynamic memory)
Disables UAC (registry)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Suspect Svchost Activity
Sigma detected: Suspicious Add Scheduled Task From User AppData Temp
Sigma detected: Suspicious Svchost Process
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file / registry access)
Uses dynamic DNS services
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 588078 Sample: TSLpexqK42.exe Startdate: 13/03/2022 Architecture: WINDOWS Score: 100 78 part-0032.t-0009.fb-t-msedge.net 2->78 80 part-0017.t-0009.fb-t-msedge.net 2->80 82 8 other IPs or domains 2->82 98 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->98 100 Malicious sample detected (through community Yara rule) 2->100 102 Multi AV Scanner detection for dropped file 2->102 104 10 other signatures 2->104 10 TSLpexqK42.exe 7 2->10         started        signatures3 process4 file5 72 C:\Users\user\AppData\...\LlZXwKofvLl.exe, PE32 10->72 dropped 74 C:\Users\user\AppData\Local\...\tmp25D9.tmp, XML 10->74 dropped 76 C:\Users\user\AppData\...\TSLpexqK42.exe.log, ASCII 10->76 dropped 112 Detected unpacking (creates a PE file in dynamic memory) 10->112 114 Contains functionality to steal Chrome passwords or cookies 10->114 116 Contains functionality to inject code into remote processes 10->116 118 5 other signatures 10->118 14 TSLpexqK42.exe 3 12 10->14         started        18 TSLpexqK42.exe 10->18         started        20 powershell.exe 25 10->20         started        22 schtasks.exe 1 10->22         started        signatures6 process7 dnsIp8 94 transfer.sh 144.76.136.153, 443, 49777 HETZNER-ASDE Germany 14->94 96 305way.duckdns.org 194.31.98.93, 22301, 49769, 49773 BURSABILTR Netherlands 14->96 120 Writes to foreign memory regions 14->120 122 Allocates memory in foreign processes 14->122 124 Injects a PE file into a foreign processes 14->124 24 TSLpexqK42.exe 14->24         started        27 cmd.exe 14->27         started        29 TSLpexqK42.exe 14->29         started        39 8 other processes 14->39 31 chrome.exe 18->31         started        33 chrome.exe 18->33         started        35 conhost.exe 20->35         started        37 conhost.exe 22->37         started        signatures9 process10 signatures11 106 Tries to steal Instant Messenger accounts or passwords 24->106 108 Tries to steal Mail credentials (via file / registry access) 24->108 41 reg.exe 27->41         started        44 conhost.exe 27->44         started        46 chrome.exe 31->46         started        48 chrome.exe 33->48         started        50 chrome.exe 39->50         started        53 chrome.exe 39->53         started        55 chrome.exe 39->55         started        57 4 other processes 39->57 process12 dnsIp13 110 Disables UAC (registry) 41->110 84 192.168.2.1 unknown unknown 50->84 86 239.255.255.250 unknown Reserved 50->86 59 chrome.exe 50->59         started        62 chrome.exe 53->62         started        64 chrome.exe 55->64         started        66 chrome.exe 57->66         started        68 chrome.exe 57->68         started        70 chrome.exe 57->70         started        signatures14 process15 dnsIp16 88 part-0032.t-0009.fb-t-msedge.net 13.107.253.60, 443, 49794, 49795 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 59->88 90 googlehosted.l.googleusercontent.com 142.250.185.65, 443, 49855, 60111 GOOGLEUS United States 59->90 92 10 other IPs or domains 59->92
Detection:
remcos
Create hunting rule
Link:
https://mwdb.cert.pl/sample/6a182d41a2d215552343174e699a7dba2d6282136f338a88826ac5eac8f0e7f6/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-03-12 09:45:34 UTC
File Type:
PE (.Net Exe)
Extracted files:
16
AV detection:
22 of 27 (81.48%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nimc2qnc2ikvki2dc5hgtgt5xiwwfaqtn4zyvcecnlc6vshq473a._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
09b75cdc3edcad3cc8b1729683a1132506e851c9d7a1d864fc842284822d1ba5
RemcosRAT
4d1cfc06d50c33a02572d8d32f34c277bb89bad8d2932c4e0549409d98d5ddda
RemcosRAT
7b5f70276fe64b0ec64ff186af6706b1dbbf2e2dc69e4b1546745b293121116f
RemcosRAT
88a52cb96bc7ae6d6788e1c3f4bca7c4bd379037cba08c6a86f28694f767d9d9
RemcosRAT
a5235adab75f69fd47b814a81ed89fe195e9a37e59c742e42363379742fc3b43
RemcosRAT
cc93c7587dba9e4af2265a77a349230cb8ab0a0d8c524f4cfad4886fad7a34ab
RemcosRAT
eb1d29174d0a65b4ff95f172d35532666fed7cd6659ec77591240777b5b76452
RemcosRAT
+ 2'995 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:nanocore family:remcos botnet:newbot brand:microsoft collection evasion keylogger persistence phishing rat spyware stealer suricata trojan
Link:
https://tria.ge/reports/220313-sgrf9ahhck/
Behaviour
Creates scheduled task(s)
Enumerates system info in registry
Modifies Internet Explorer settings
Modifies registry class
Modifies registry key
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Program Files directory
Detected potential entity reuse from brand microsoft.
Suspicious use of SetThreadContext
Accesses Microsoft Outlook accounts
Adds Run key to start application
Checks computer location settings
Reads user/profile data of web browsers
Downloads MZ/PE file
Executes dropped EXE
NirSoft MailPassView
NirSoft WebBrowserPassView
Nirsoft
NanoCore
Remcos
UAC bypass
suricata: ET MALWARE Remocs 3.x Unencrypted Checkin
suricata: ET MALWARE Remocs 3.x Unencrypted Server Response
Malware Config
C2 Extraction:
305way.duckdns.org:22301
305way.duckdns.org:22302
305way.duckdns.org:22303
305way.duckdns.org:22304
305way.duckdns.org:22305
305way.duckdns.org:22306
127.0.0.1:22306
Unpacked files
SH256 hash:
9cd86a96a56d405880b2ffe2c26ebcb1af06f4371a22be1443aa9590e054d6c4
MD5 hash:
2278ec056fa794d545258c690bc3db57
SHA1 hash:
cb76fa85b156d6402c8b7f774883fcceccb7aa65
Link:
https://www.unpac.me/results/7a18fd16-beab-418e-8c23-2526e3572809/
SH256 hash:
a7d839b1e63abea8f631e3a219f584422527c4527125b8b532edcbeab45d390e
MD5 hash:
34662e3df497137549dc9e67ebe0e58b
SHA1 hash:
c5158f1231dee388d25b542fdadf94f6ebc2a1e3
Link:
https://www.unpac.me/results/7a18fd16-beab-418e-8c23-2526e3572809/
SH256 hash:
60023d65f8572a590e7c9fc6ab8aa4b314ad3ce423b33a8e7e7bd1f38b2f4383
MD5 hash:
ce00234ff01cf8346b911171c3998d59
SHA1 hash:
95c28bbbf900ffc5e051e7f8e88065d2f0ace376
Link:
https://www.unpac.me/results/7a18fd16-beab-418e-8c23-2526e3572809/
SH256 hash:
175285bfa8a73b3990f54994b8825c1f3396635bc344939cd8d9fc60b9569b46
MD5 hash:
f26eb90c6addfc99fa0c2e63896216d2
SHA1 hash:
77e01b96d8c211d4d24fc0a1aae91122caf5f668
Link:
https://www.unpac.me/results/7a18fd16-beab-418e-8c23-2526e3572809/
SH256 hash:
6a182d41a2d215552343174e699a7dba2d6282136f338a88826ac5eac8f0e7f6
MD5 hash:
efb024da581e627180972c9f742daff4
SHA1 hash:
256e1af8f4650520b1cf41f00e449b6e85510daa
Link:
https://www.unpac.me/results/7a18fd16-beab-418e-8c23-2526e3572809/
Malware family:
Remcos
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/6a182d41a2d2/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6a182d41a2d215552343174e699a7dba2d6282136f338a88826ac5eac8f0e7f6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/249876/

Comments