MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 78dedaf861e8a8b88b1419aebf37a74be707f531dce0804f970c70f372b2a247. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
RemoteManipulator
Vendor detections: 10
| SHA256 hash: | 78dedaf861e8a8b88b1419aebf37a74be707f531dce0804f970c70f372b2a247 |
|---|---|
| SHA3-384 hash: | e58675c7cea7e0055d9e2fbe2d68d07c92d946dc0c454d719689bec950eec24adc2a48a2a4dc494a8d5c9aeb1cbe44a3 |
| SHA1 hash: | 0394329a87f8a56b36a03b9da69ca85eed32e650 |
| MD5 hash: | c3aa23331cded10fbfcd36406ed913b1 |
| humanhash: | butter-four-sweet-eleven |
| File name: | c3aa23331cded10fbfcd36406ed913b1.exe |
| Download: | download sample |
| Signature | RemoteManipulator |
| File size: | 16'183'408 bytes |
| First seen: | 2022-02-20 11:36:04 UTC |
| Last seen: | 2022-02-20 14:03:14 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 19b321cb7a9ce31c90397152f38b67ea (29 x RemoteManipulator) |
| ssdeep | 393216:ceYlLQXpuX293SF2pSlxYtfuX71JEmcZJrpSjwEvZ:nYO5uX293F/BurfEJIjtR |
| TLSH | T167F63356F7E21824C4BA4B7F0ABD5B102B7ABC9C5A1357CC03A9F12D9C7A74149B039B |
| File icon (PE): |  |
| dhash icon | c4dacabacac0c244 (47 x RemoteManipulator) |
| Reporter |  abuse_ch |
| Tags: | exe RemoteManipulator signed |
Code Signing Certificate
| Organisation: | Remote Utilities LLC |
|---|---|
| Issuer: | Sectigo RSA Code Signing CA |
| Algorithm: | sha256WithRSAEncryption |
| Valid from: | 2020-08-18T00:00:00Z |
| Valid to: | 2022-08-18T23:59:59Z |
| Serial number: | aab0e5906afead7b956937974d8016ef |
| Intelligence: | 13 malware samples on MalwareBazaar are signed with this code signing certificate |
| Thumbprint Algorithm: | SHA256 |
| Thumbprint: | cae7c89d5c445a4d774e14192fbcc6bb80658f183cec22da8146317446c33628 |
| Source: | This information was brought to you by ReversingLabs A1000 Malware Analysis Platform |
Indicators Of Compromise (IOCs)
Below is a list of indicators of compromise (IOCs) associated with this malware samples.
| IOC | ThreatFox Reference |
|---|---|
| 66.23.226.254:5655 | https://threatfox.abuse.ch/ioc/389599/ |
Intelligence
File Origin
# of uploads :
2
# of downloads :
248
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
78dedaf861e8a8b88b1419aebf37a74be707f531dce0804f970c70f372b2a247.zip
Verdict:
Malicious activity
Analysis date:
2022-02-20 13:03:28 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Result
Verdict:
Malware
Maliciousness:
Behaviour
Сreating synchronization primitives
Creating a window
Searching for synchronization primitives
Creating a file in the %AppData% subdirectories
Creating a process from a recently created file
Launching a service
DNS request
Sending a custom TCP request
Creating a file in the Windows subdirectories
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
control.exe greyware overlay packed remote.exe remoteadmin replace.exe virus
Result
Verdict:
UNKNOWN
Verdict:
Malicious
Result
Threat name:
RMSRemoteAdmin
Detection:
malicious
Classification:
spyw.evad
Score:
42 / 100
Signature
Found API chain indicative of debugger detection
Found evasive API chain (may stop execution after checking system information)
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Query firmware table information (likely to detect VMs)
Tries to steal Mail credentials (via file registry)
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.RemoteUtilities
Status:
Malicious
First seen:
2022-02-13 04:04:17 UTC
File Type:
PE (Exe)
Extracted files:
85
AV detection:
14 of 28 (50.00%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Result
Malware family:
rms
Score:
10/10
Tags:
family:rms rat trojan upx
Behaviour
Checks processor information in registry
Modifies data under HKEY_USERS
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Windows directory
Drops file in System32 directory
Checks computer location settings
Loads dropped DLL
Executes dropped EXE
RMS
Unpacked files
SH256 hash:
ae2c70e7adaf87d651b123e1ba89575f692eb48599f13a2c296caf155600d347
MD5 hash:
4210da833efe9decbe9248f1350dd27f
SHA1 hash:
6408c38b595fd140068686313a26af78ee9c1568
SH256 hash:
f93dfd03fb2e60394ddaac651eb2a0fdb8353f6aab04160d9c31bb3d359e83e4
MD5 hash:
c9eb45179b6a4fa5ac8d80bc15cafb40
SHA1 hash:
c7216b264bd96b44fc741443c07910afe7d8c624
SH256 hash:
b675c40e8021a3c1d3918d266c92d4125d4fa2e80b72e7161ebc24b45c801387
MD5 hash:
b37b8328a167c87abbb9f19ccce5245a
SHA1 hash:
7f660856347430bfd5fafac9c47eba079295ac21
SH256 hash:
8fed25090ad30eb4d0b61b2de3f93d935bad799befe10491b88669085e1ea480
MD5 hash:
c1a46b9bf24be7152a79face24f6937f
SHA1 hash:
7623e7d2dde70fcca41d95e9b85c8425e9976a8e
SH256 hash:
117766cbd5236c18ed77661ff57975c7f8f303c478fa5b676eb5b0421f88a654
MD5 hash:
c052594ee06dc34d19f3e8025ec4d33e
SHA1 hash:
006ad27ebd2bd3b2eda7b9e55b9bce2297666d43
SH256 hash:
8413d19258f22c67353929a5b72e627a54f46d04ffee53e613fc56961263add2
MD5 hash:
400d4c86355e936d0d9e2d411b57f0ca
SHA1 hash:
31b865e0f468f56fd7cf1c2b97de413451117be9
Detections:
win_rms_a0
win_rms_auto
SH256 hash:
4c456dd58295789a678cf658fb5e20e13f3b7be65a04fa63623471a8da7e9139
MD5 hash:
f0a78712c38f93d9372e34185ef21b40
SHA1 hash:
f433ea50fad0b4aeb16d4be32fabb702771e5704
Detections:
win_rms_a0
SH256 hash:
78dedaf861e8a8b88b1419aebf37a74be707f531dce0804f970c70f372b2a247
MD5 hash:
c3aa23331cded10fbfcd36406ed913b1
SHA1 hash:
0394329a87f8a56b36a03b9da69ca85eed32e650
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | Adsterra_Adware_DOM |
|---|---|
| Author: | IlluminatiFish |
| Description: | Detects Adsterra adware script being loaded without the user's consent |
| Rule name: | BitcoinAddress |
|---|---|
| Author: | Didier Stevens (@DidierStevens) |
| Description: | Contains a valid Bitcoin address |
| Rule name: | MALWARE_Win_RemoteUtilitiesRAT |
|---|---|
| Author: | ditekSHen |
| Description: | RemoteUtilitiesRAT RAT payload |
| Rule name: | Sectigo_Code_Signed |
|---|---|
| Description: | Detects code signed by the Sectigo RSA Code Signing CA |
| Reference: | https://bazaar.abuse.ch/export/csv/cscb/ |
| Rule name: | win_rms_auto |
|---|---|
| Author: | Felix Bilstein - yara-signator at cocacoding dot com |
| Description: | autogenerated rule brought to you by yara-signator |
| Rule name: | with_urls |
|---|---|
| Author: | Antonio Sanchez <asanchez@hispasec.com> |
| Description: | Rule to detect the presence of an or several urls |
| Reference: | http://laboratorio.blogs.hispasec.com/ |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
No further information available
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.