MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 73feac20d7cdbe1e10ca26b196d60d68ea0c4e652ceacf534b1c549e4e597e74. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 73feac20d7cdbe1e10ca26b196d60d68ea0c4e652ceacf534b1c549e4e597e74
SHA3-384 hash: 4ac184b2f3c9a11d24cd2ee5c0a09cbd3b1d748d1c22f2343368ab94e843a9d94390f721c774156e5fd2e56b6bdfdd72
SHA1 hash: 8199b12cc24d416cb8835b5e3d00b92339ad9b45
MD5 hash: 0d0c318096299a617f70ea57559c4f55
humanhash: robin-item-nebraska-magnesium
File name:Vidoe001mp4.scr signed FAT11 d.o.o
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'248'936 bytes
First seen:2020-10-23 10:23:49 UTC
Last seen:2020-10-23 11:22:21 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash edfbdfed5b78ad46d0ce1f4c7ce0f17a (1 x RemcosRAT, 1 x ParallaxRAT)
ssdeep 24576:4I+nN/3iMvbMVqGtWdne/F9kG8Mlp++kFvSsfVE:4I+nByMp9eweyzfVE
Threatray 3 similar samples on MalwareBazaar
TLSH BD456B22A6918837D4631B384E6FA7A56939BF042E35899F67F01D4C1F3978138392F7
Reporter JAMESWT_WT
Tags:FAT11 d.o.o. RemcosRAT

Code Signing Certificate

Organisation:DigiCert High Assurance EV Root CA
Issuer:DigiCert High Assurance EV Root CA
Algorithm:sha1WithRSAEncryption
Valid from:Nov 10 00:00:00 2006 GMT
Valid to:Nov 10 00:00:00 2031 GMT
Serial number: 02AC5C266A0B409B8F0B79F2AE462577
Intelligence: 204 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: 7431E5F4C3C1CE4690774F0B61E05440883BA9A01ED00BA6ABD7806ED3B118CF
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
2
# of downloads :
98
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/75014/
Detection(s):
PUA.Win.Packer.BorlandCpp-9
Create hunting rule

PUA.Win.Adware.Webalta-6862190-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a process
Sending a UDP request
Transferring files using the Background Intelligent Transfer Service (BITS)
DNS request
Sending a custom TCP request
Creating a file in the %temp% directory
Deleting a recently created file
Unauthorized injection to a recently created process
Creating a process from a recently created file
Creating a file in the %AppData% subdirectories
Enabling the 'hidden' option for recently created files
Moving a file to the %AppData% subdirectory
Creating a file
Setting a keyboard event handler
Sending an HTTP GET request
Setting browser functions hooks
Unauthorized injection to a system process
Enabling autorun by creating a file
Sending an HTTP GET request to an infection source
Unauthorized injection to a browser process
Result
Threat name:
Kronos Remcos
Create hunting rule
Detection:
malicious
Classification:
rans.bank.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/508019
Signature
Allocates memory in foreign processes
Antivirus detection for dropped file
Contains functionality to capture and log keystrokes
Contains functionality to detect sleep reduction / modifications
Contains functionality to inject code into remote processes
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Contains functionalty to change the wallpaper
Detected Kronos e-Banking malware
Detected Remcos RAT
Detected unpacking (creates a PE file in dynamic memory)
Found Tor onion address
Hijacks the control flow in another process
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
May check the online IP address of the machine
May use the Tor software to hide its network traffic
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Sigma detected: Remcos
Tries to harvest and steal browser information (history, passwords, etc)
Uses ipconfig to lookup or modify the Windows network settings
Writes to foreign memory regions
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 303130 Sample: Vidoe001mp4.scr signed FAT1... Startdate: 23/10/2020 Architecture: WINDOWS Score: 100 56 ipv4.imgur.map.fastly.net 2->56 58 i.imgur.com 2->58 72 Malicious sample detected (through community Yara rule) 2->72 74 Multi AV Scanner detection for submitted file 2->74 76 Detected Remcos RAT 2->76 78 8 other signatures 2->78 12 Vidoe001mp4.scr signed FAT11 d.o.exe 2->12         started        15 bac58a5f.exe 1 2->15         started        17 remcos.exe 2->17         started        19 remcos.exe 2->19         started        signatures3 process4 signatures5 88 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 12->88 90 Hijacks the control flow in another process 12->90 92 Writes to foreign memory regions 12->92 94 Allocates memory in foreign processes 12->94 21 ipconfig.exe 16 12->21         started        26 conhost.exe 15->26         started        process6 dnsIp7 60 ipv4.imgur.map.fastly.net 151.101.112.193, 443, 49696, 49701 FASTLYUS United States 21->60 62 i.imgur.com 21->62 52 C:\Users\user\AppData\Local\Temp\cmd.exe, PE32 21->52 dropped 80 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 21->80 82 Hijacks the control flow in another process 21->82 84 Writes to foreign memory regions 21->84 86 Maps a DLL or memory area into another process 21->86 28 cmd.exe 2 10 21->28         started        33 conhost.exe 21->33         started        file8 signatures9 process10 dnsIp11 64 93.115.86.9, 49726, 80 VOXILITYGB United Kingdom 28->64 66 185.118.68.35, 49717, 80 VCORE-ASFR France 28->66 68 35 other IPs or domains 28->68 54 C:\Users\user\AppData\...behaviorgraphetX64BTIT.exe, PE32+ 28->54 dropped 104 Detected unpacking (creates a PE file in dynamic memory) 28->104 106 Detected Kronos e-Banking malware 28->106 108 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 28->108 110 3 other signatures 28->110 35 G.exe 4 4 28->35         started        38 GetX64BTIT.exe 1 28->38         started        file12 signatures13 process14 file15 50 C:\Users\user\AppData\Roaming\...\remcos.exe, PE32 35->50 dropped 40 wscript.exe 1 35->40         started        process16 process17 42 cmd.exe 1 40->42         started        process18 44 remcos.exe 2 3 42->44         started        48 conhost.exe 42->48         started        dnsIp19 70 108.174.197.5, 49732, 49733, 49734 HOSTWINDSUS United States 44->70 96 Antivirus detection for dropped file 44->96 98 Multi AV Scanner detection for dropped file 44->98 100 Contains functionalty to change the wallpaper 44->100 102 5 other signatures 44->102 signatures20
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/73feac20d7cdbe1e10ca26b196d60d68ea0c4e652ceacf534b1c549e4e597e74/
Threat name:
Win32.Trojan.GenCBL
Create hunting rule
Status:
Malicious
First seen:
2020-10-22 09:34:46 UTC
File Type:
PE (Exe)
Extracted files:
123
AV detection:
21 of 25 (84.00%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
111b63f31d1e6855b0bc722107ac4f5668a7f115fd45654625eb41a6160828c6
RemcosRAT
4da8564def807d49cf9d45fcad3e9201344732a49aea4261ab05b8b43cb3adae
RemcosRAT
62bd38c89d1a30b03bd89a788d9f2852659f77715c97e5c12445c33f43fa13e5
RemcosRAT
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
spyware banker botnet family:osiris rat family:remcos persistence
Link:
https://tria.ge/reports/201023-bg9x3mpdzn/
Behaviour
Gathers network information
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Modifies registry class
Drops file in Windows directory
Looks up external IP address via web service
Adds Run key to start application
Loads dropped DLL
Reads user/profile data of web browsers
Executes dropped EXE
Osiris
Remcos
Malware Config
C2 Extraction:
108.174.197.5:5050
Unpacked files
SH256 hash:
73feac20d7cdbe1e10ca26b196d60d68ea0c4e652ceacf534b1c549e4e597e74
MD5 hash:
0d0c318096299a617f70ea57559c4f55
SHA1 hash:
8199b12cc24d416cb8835b5e3d00b92339ad9b45
Link:
https://www.unpac.me/results/78fac56f-eb67-458a-8e10-eb1ac796cd85/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Backdoor
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/73feac20d7cdbe1e10ca26b196d60d68ea0c4e652ceacf534b1c549e4e597e74

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/75014/

Comments