MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 731c1dbc6fbb07d9a10b103428f7722e6f758d74815c25758cc4ab5b79ed8510. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemcosRAT

Vendor detections: 12

Intelligence 12 IOCs YARA 2 File information Comments

SHA256 hash:	731c1dbc6fbb07d9a10b103428f7722e6f758d74815c25758cc4ab5b79ed8510
SHA3-384 hash:	93f2fe08ee3e13f02975415b75063aab6dfce2ebb0d4f4cdd576ab8eb714cd3883448fc0e07621a5c7f486b704839050
SHA1 hash:	a7035c0bf25cb84c6fd7248d3e6048b1a162becd
MD5 hash:	76e8a959916086ab95bcff0c5ce195c9
humanhash:	shade-august-jupiter-river
File name:	76e8a959916086ab95bcff0c5ce195c9.exe
Download:	download sample
Signature	RemcosRAT Create hunting rule
File size:	4'300'288 bytes
First seen:	2022-08-30 13:58:18 UTC
Last seen:	2022-08-30 14:53:50 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	24b92ccf1e266e626a6cc7126f975fe5 (7 x RemcosRAT)
ssdeep	98304:pI8qGgyL/j7n3Zd7fqCt/PvAJkIEVrqHwsHt/Y:pzLbjJFyC1nGkvVrkH
TLSH	T17D16237723A45048F5D8CC398937BDB031F6567BCA81BCBE55EEA9C627158A4F213A03
TrID	29.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 22.7% (.EXE) Win16 NE executable (generic) (5038/12/1) 20.3% (.EXE) Win32 Executable (generic) (4505/5/1) 9.1% (.EXE) OS/2 Executable (generic) (2029/13) 9.0% (.EXE) Generic Win/DOS Executable (2002/3)
Reporter	abuse_ch
Tags:	exe RAT RemcosRAT

Intelligence

File Origin

# of uploads :

# of downloads :

323

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

remcos

ID:

File name:

76e8a959916086ab95bcff0c5ce195c9.exe

Verdict:

Malicious activity

Analysis date:

2022-08-30 13:58:43 UTC

Tags:

remcos

Link:

https://app.any.run/tasks/f9ee690d-eef3-4642-b62b-2094a6fdf9e4

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/302578/

Detection(s):

SecuriteInfo.com.Trojan.Heur.TP.@FW@bWBBtDd.181.4448.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Setting a keyboard event handler

Creating a window

DNS request

Creating a file in the %temp% subdirectories

Sending a custom TCP request

Sending an HTTP GET request

Creating a file

Creating a process from a recently created file

Running batch commands

Creating a process with a hidden window

Creating a file in the %AppData% subdirectories

Launching a process

Using the Windows Management Instrumentation requests

Creating a file in the %AppData% directory

Connecting to a cryptocurrency mining pool

Creating a service

Launching a service

Loading a system driver

Creating a file in the Windows subdirectories

Sending an HTTP POST request

Unauthorized injection to a recently created process

Enabling autorun for a service

Unauthorized injection to a system process

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

greyware packed

Link:

https://www.filescan.io/uploads/630e18715e025f2e7b030dc5/reports/7b462def-05e6-469e-99b7-1ede2760def5/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/e41a2390-a3f0-49b9-8e53-f0a10c7868c7

Result

Threat name:

PrivateLoader, Remcos

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1060621

Signature

Antivirus / Scanner detection for submitted sample

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect virtualization through RDTSC time measurements

Writes to foreign memory regions

Yara detected PrivateLoader

Yara detected Remcos RAT

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/731c1dbc6fbb07d9a10b103428f7722e6f758d74815c25758cc4ab5b79ed8510/

Threat name:

Win32.Trojan.Fragtor

Status:

Malicious

First seen:

2022-08-30 13:59:15 UTC

File Type:

PE (Exe)

AV detection:

20 of 25 (80.00%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=omob3pdpxmd5tiilca2cr53sfzxxldluqfock5mmysvvw6pnquia._file

Result

Malware family:

remcos

Score:

10/10

Tags:

family:remcos rat

Link:

https://tria.ge/reports/220830-radq5shghk/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Remcos

Unpacked files

SH256 hash:

97e6b94fb1209c750530e902f1332ad987ea176025bfdd473ad47798bbddc780

MD5 hash:

359087609bac7c31b81f3f21bb5c3777

SHA1 hash:

987365e0f90a1cc7844f4be5ec7022b6509737af

Link:

https://www.unpac.me/results/1f84ca0d-6ca9-4256-9b96-64ac70daa63a/

SH256 hash:

731c1dbc6fbb07d9a10b103428f7722e6f758d74815c25758cc4ab5b79ed8510

MD5 hash:

76e8a959916086ab95bcff0c5ce195c9

SHA1 hash:

a7035c0bf25cb84c6fd7248d3e6048b1a162becd

Link:

https://www.unpac.me/results/1f84ca0d-6ca9-4256-9b96-64ac70daa63a/

Malware family:

XMRig

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/731c1dbc6fbb/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

iSpy Keylogger

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/731c1dbc6fbb07d9a10b103428f7722e6f758d74815c25758cc4ab5b79ed8510

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer Create hunting rule
Author:	ditekSHen
Description:	detects Windows exceutables potentially bypassing UAC using eventvwr.exe