MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6c31c906b79f6b7e04ebbf079735b5a1052f4df211a161fe887b6df8bd0c9eee. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 16


Intelligence 16 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6c31c906b79f6b7e04ebbf079735b5a1052f4df211a161fe887b6df8bd0c9eee
SHA3-384 hash: 8f71af2de59be0629cf4c5baa04eb184b4c8e21fda9e2fff104d1cc4ea2d138ac6b754c37f47058a213d86bc168c9ef9
SHA1 hash: 4d9c087e721b0dee21a3559bae437c45a24c22d3
MD5 hash: f94c1293324f4cbad927f399dbed2d15
humanhash: pip-triple-robert-oregon
File name:SecuriteInfo.com.Win32.CrypterX-gen.241.13129
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'010'688 bytes
First seen:2024-01-30 04:20:43 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'454 x Formbook, 12'202 x SnakeKeylogger)
ssdeep 24576:kF29Zd/91EA98GDCUtSS6nNvLs8BgNjTcwIIOhHDb0dyoM:kFgZcdGDZijs7jT9OHDb0j
Threatray 3'358 similar samples on MalwareBazaar
TLSH T13425232273905917C11A47B9DE204AEE47B6AE523F86E7CF5CC074AE11B3B9B538131B
TrID 63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.2% (.SCR) Windows screen saver (13097/50/3)
9.0% (.EXE) Win64 Executable (generic) (10523/12/4)
5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 71e8d4d469e8cc68 (19 x AgentTesla, 5 x Formbook, 3 x SnakeKeylogger)
Reporter SecuriteInfoCom
Tags:exe RemcosRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
529
Origin country :
FR FR
Vendor Threat Intelligence
Detection:
Remcos
Create hunting rule
Link:
https://www.capesandbox.com/analysis/473550/
Detection(s):
SecuriteInfo.com.Win32.CrypterX-gen.241.13129.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Launching a process
Creating a file
Launching the default Windows debugger (dwwin.exe)
Searching for the window
Forced shutdown of a system process
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed remcos
Link:
https://www.filescan.io/uploads/65b8792f4aed8b65c87b44d0/reports/dc934dbe-f162-4505-86d7-45f2939b663a/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/6c31c906b79f6b7e04ebbf079735b5a1052f4df211a161fe887b6df8bd0c9eee
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
REMCOS
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/02bb8ab9-4280-4f90-b2df-c7e9014028c3
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
rans.troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1383131
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Contains functionality to bypass UAC (CMSTPLUA)
Contains functionality to register a low level keyboard hook
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Contains functionalty to change the wallpaper
Delayed program exit found
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected Remcos RAT
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/6c31c906b79f6b7e04ebbf079735b5a1052f4df211a161fe887b6df8bd0c9eee
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6c31c906b79f6b7e04ebbf079735b5a1052f4df211a161fe887b6df8bd0c9eee/
Threat name:
Win32.Backdoor.Remcos
Create hunting rule
Status:
Malicious
First seen:
2024-01-30 04:21:06 UTC
File Type:
PE (.Net Exe)
Extracted files:
20
AV detection:
16 of 23 (69.57%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nqy4sbvxt5vx4bhlx4dzonnvuecs6tpscgqwd7uipnw7rpimt3xa._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
1c6b0eb5c224c46a65fb5022852905a1293a148bd97bb81593b813e8ed814ba8
RemcosRAT
455081f6fed14906ac4cbd035d37910a2d06776371f064e8dd94700f120ed6fd
RemcosRAT
483d7f7379d43c9fb3effb226cb58a443f48105bda3a9a6310a76729d7c1b3bd
RemcosRAT
4eecb3d02825158bc36d86c8d75f37137a11576eb8fb9fec7e592648fd369f96
RemcosRAT
6ada953ec661fe2a23fefa4a5801db675a659a445bdbb348ecb019b3f1954e36
RemcosRAT
6c31c906b79f6b7e04ebbf079735b5a1052f4df211a161fe887b6df8bd0c9eee
RemcosRAT
+ 3'348 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos rat
Link:
https://tria.ge/reports/240130-eym89shfam/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Remcos
Unpacked files
SH256 hash:
f257cb33f05fa76fdbb6baa2766fcbca6a70589e8da40f7c5402d499c1156ac0
MD5 hash:
92109c544f582c5e87f40e221728f843
SHA1 hash:
d8ec78b2ee8335ff583285d332506075c1379f85
Link:
https://www.unpac.me/results/ba6f4028-93f5-43a2-8aec-9489cb01076a/
SH256 hash:
141e38a91643ce700ee028d934001d8f634e0575059de801dfecdf7c5281c895
MD5 hash:
72a4a4c4948c3280b857b32972fa0513
SHA1 hash:
cf74094224f910ba01f14f278d1ed5020ed6c8a7
Detections:
Remcos
Create hunting rule
win_remcos_w0
Create hunting rule
win_remcos_auto
Create hunting rule
malware_windows_remcos_rat
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
Create hunting rule
Link:
https://www.unpac.me/results/ba6f4028-93f5-43a2-8aec-9489cb01076a/
SH256 hash:
a895615d1a578509e508525b5eabb30787f994859db6a10dfca199a847099248
MD5 hash:
c16571e66609ef65766c670fd1c89f75
SHA1 hash:
576133eed4e05b89b2e8ae7e7a215d39b52623ac
Link:
https://www.unpac.me/results/ba6f4028-93f5-43a2-8aec-9489cb01076a/
SH256 hash:
3014b859be7cafca84f61ab3398e0832d80175d76dc6ff4a45df7b2fef39dcaf
MD5 hash:
17cbde8bc5d57e164c1daa95d1b37d0b
SHA1 hash:
4856da540fd30d018fa511c9ce705871e1e2affa
Link:
https://www.unpac.me/results/ba6f4028-93f5-43a2-8aec-9489cb01076a/
SH256 hash:
6c31c906b79f6b7e04ebbf079735b5a1052f4df211a161fe887b6df8bd0c9eee
MD5 hash:
f94c1293324f4cbad927f399dbed2d15
SHA1 hash:
4d9c087e721b0dee21a3559bae437c45a24c22d3
Link:
https://www.unpac.me/results/ba6f4028-93f5-43a2-8aec-9489cb01076a/
Malware family:
Remcos
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/6c31c906b79f/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6c31c906b79f6b7e04ebbf079735b5a1052f4df211a161fe887b6df8bd0c9eee

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/473550/

Comments