MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 71c5a4261cc336e193cef7e3e397e160a1a24998185a9458338276e5a8091d63. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 9


Intelligence 9 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 71c5a4261cc336e193cef7e3e397e160a1a24998185a9458338276e5a8091d63
SHA3-384 hash: 3446f5f6718568e61b91e391f26720b14686e4b8d6bb097d0918fbd8de928d88f4ba0ced0a3deef71072157ebfca7feb
SHA1 hash: 4c7689c03cd9035ec106fd6345f6db2c9187ea5d
MD5 hash: 21885daa3ec7812ba80b8eb727af879c
humanhash: emma-romeo-helium-yellow
File name:Document.exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:718'848 bytes
First seen:2021-09-24 13:51:29 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 9a7ebf1a69de9b324d0d1f73a7d054a0 (6 x RemcosRAT, 1 x Formbook)
ssdeep 12288:mftAn+lE3hGAJNmUaxoSThjczmQgMM4PW:4uwEwomU1SFA2D
Threatray 633 similar samples on MalwareBazaar
TLSH T190E43A395344D9B9F2750F78CCDC5620282BB9B139B88D554AB83E0FA6358C5381F6EB
File icon (PE):PE icon
dhash icon c4dcf8c6d6d0c8d4 (21 x RemcosRAT, 3 x Formbook, 1 x AveMariaRAT)
Reporter GovCERT_CH
Tags:exe RemcosRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
167
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Document.exe
Verdict:
Malicious activity
Analysis date:
2021-09-24 13:52:09 UTC
Tags:
rat remcos keylogger
Link:
https://app.any.run/tasks/82e29e8c-c775-4a0e-806d-ae87a3dfe16c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/191195/
Detection(s):
SecuriteInfo.com.Variant.Zusy.401770.18517.18716.UNOFFICIAL
Create hunting rule

Malware family:
REMCOS
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/76b977ba-5ff8-4bfd-9399-6a0f8ad58e4f
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/857401
Signature
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Creates a thread in another existing process (thread injection)
Delayed program exit found
Detected Remcos RAT
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Uses dynamic DNS services
Writes to foreign memory regions
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 489830 Sample: Document.exe Startdate: 24/09/2021 Architecture: WINDOWS Score: 100 63 Found malware configuration 2->63 65 Malicious sample detected (through community Yara rule) 2->65 67 Detected Remcos RAT 2->67 69 4 other signatures 2->69 8 Document.exe 1 22 2->8         started        13 Eqlbcni.exe 15 2->13         started        15 Eqlbcni.exe 15 2->15         started        process3 dnsIp4 49 onedrive.live.com 8->49 57 2 other IPs or domains 8->57 41 C:\Users\Public\Libraries\...qlbcni.exe, PE32 8->41 dropped 79 Writes to foreign memory regions 8->79 81 Creates a thread in another existing process (thread injection) 8->81 83 Injects a PE file into a foreign processes 8->83 17 logagent.exe 2 3 8->17         started        21 cmd.exe 1 8->21         started        23 cmd.exe 1 8->23         started        51 onedrive.live.com 13->51 59 2 other IPs or domains 13->59 25 secinit.exe 13->25         started        53 192.168.2.1 unknown unknown 15->53 55 onedrive.live.com 15->55 61 2 other IPs or domains 15->61 27 logagent.exe 15->27         started        file5 signatures6 process7 dnsIp8 43 salford3.ddns.net 185.236.203.119, 2404 M247GB Romania 17->43 45 salford2.ddns.net 17->45 47 salford1.ddns.net 17->47 71 Contains functionality to steal Chrome passwords or cookies 17->71 73 Contains functionality to inject code into remote processes 17->73 75 Contains functionality to steal Firefox passwords or cookies 17->75 77 Delayed program exit found 17->77 29 reg.exe 1 21->29         started        31 conhost.exe 21->31         started        33 cmd.exe 1 23->33         started        35 conhost.exe 23->35         started        signatures9 process10 process11 37 conhost.exe 29->37         started        39 conhost.exe 33->39         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/71c5a4261cc336e193cef7e3e397e160a1a24998185a9458338276e5a8091d63/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2021-09-24 13:52:11 UTC
AV detection:
22 of 45 (48.89%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ohc2ijq4ym3ode6o67r6hf7bmcq2esmydbnjiwbtqj3olkajdvrq._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
5ce84e35cdb6590c162cd421a8a281385bc9195fb4ce3e2e589280ca8903d3b6
RemcosRAT
5f14d3a74387554c330e7ee790f26fb55c5bfeb1dbefc6f2de93ba69d46383e8
RemcosRAT
61005cab010bde9798cb5c7ee05497c08ba71d638644f05a1b5e58c8eac67ca1
RemcosRAT
63f039f6024860da44bd5522c38e55e7ab19cf47735d348c6046fd1bdacba6b2
RemcosRAT
68f59f9ceb6a93c4ce1cb450202bd0dd021543c5bf60d82f36c86252a5bd69e8
RemcosRAT
7ede77932ce7a1fb54f227934c436ce1d0f746efce80e66a7664a4f7bfc909cf
RemcosRAT
8d076437949873b971f9534e630ebe26a8437f50786c430eaeb46c71d53a88e5
RemcosRAT
8fa72e87addead9671e573d7cb843ca784a10cfbf6acf5b6bc4830df66fe0bf0
RemcosRAT
af8ee88bf85615f2c305ce230560485be949dbb7355640e0498bf93f154df714
RemcosRAT
+ 623 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:remotehost persistence rat
Link:
https://tria.ge/reports/210924-q6e4eahbf6/
Behaviour
Modifies registry key
Suspicious use of WriteProcessMemory
Adds Run key to start application
Remcos
Malware Config
C2 Extraction:
salford1.ddns.net:2404
salford2.ddns.net:2404
salford3.ddns.net:2404
Unpacked files
SH256 hash:
18498f5add7c31c1af213a720891708124ce271e4a1f4eef7427ff9ceff44767
MD5 hash:
af315fe318bcbca468841006ccc57e0a
SHA1 hash:
9b18984c1d4fcafc7bde26250a937aff6c41a375
Link:
https://www.unpac.me/results/a987d679-d6a8-4dc4-ad6f-f85157fcaac1/
SH256 hash:
71c5a4261cc336e193cef7e3e397e160a1a24998185a9458338276e5a8091d63
MD5 hash:
21885daa3ec7812ba80b8eb727af879c
SHA1 hash:
4c7689c03cd9035ec106fd6345f6db2c9187ea5d
Link:
https://www.unpac.me/results/a987d679-d6a8-4dc4-ad6f-f85157fcaac1/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/71c5a4261cc3/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/71c5a4261cc336e193cef7e3e397e160a1a24998185a9458338276e5a8091d63

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_RemcosRAT
Create hunting rule
Author:abuse.ch
Rule name:INDICATOR_SUSPICIOUS_EXE_UACBypass_EnvVarScheduledTasks
Create hunting rule
Author:ditekSHen
Description:detects Windows exceutables potentially bypassing UAC (ab)using Environment Variables in Scheduled Tasks
Rule name:INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer
Create hunting rule
Author:ditekSHen
Description:detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Rule name:Remcos
Create hunting rule
Author:kevoreilly
Description:Remcos Payload
Rule name:remcos_rat
Create hunting rule
Author:jeFF0Falltrades
Rule name:REMCOS_RAT_variants
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

Executable exe 71c5a4261cc336e193cef7e3e397e160a1a24998185a9458338276e5a8091d63

(this sample)

  
Dropped by
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/191195/

Comments