MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7b5f70276fe64b0ec64ff186af6706b1dbbf2e2dc69e4b1546745b293121116f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 8


Intelligence 8 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7b5f70276fe64b0ec64ff186af6706b1dbbf2e2dc69e4b1546745b293121116f
SHA3-384 hash: 76e6ea163bc3d4750c4b737772e099b7e32edf6128f25b1b949b0b23e529351a800b8ef8b2146804bc5d5c552196a7e6
SHA1 hash: 009eb1d6bd85625c1988d0faf283c0c6f0b68b08
MD5 hash: a5ee867d538aba1c630822fefd28180c
humanhash: salami-maine-idaho-cup
File name:latest inquiry.vbs
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:2'380 bytes
First seen:2022-02-15 09:23:27 UTC
Last seen:Never
File type:Visual Basic Script (vbs) vbs
MIME type:text/plain
ssdeep 48:KWY60jvsxCoNmGAW1VqhgbS8IH2AahkOiJW0RFQ63+LL7ZihKn:6aNmA1VR5IH2AHZjOLLNiYn
Threatray 1'969 similar samples on MalwareBazaar
TLSH T1A541408E3643E029C9124DE2EEEBC85EA9B252097979C4817B1C86C1087182CAFD89CD
Reporter adrian__luca
Tags:RemcosRAT vbs

Intelligence

File Origin
# of uploads :
1
# of downloads :
204
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/241565/
Detection(s):
SecuriteInfo.com.Trojan.VBS.SAgent.gen.7637.14489.UNOFFICIAL
Create hunting rule

Result
Verdict:
SUSPICIOUS
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/939984
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Command shell drops VBS files
Contains functionality to inject code into remote processes
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Delayed program exit found
Found malware configuration
Injects a PE file into a foreign processes
Installs a global keyboard hook
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments
System process connects to network (likely due to code injection or exploit)
Tries to steal Instant Messenger accounts or passwords
Uses dynamic DNS services
Very long command line found
Writes or reads registry keys via WMI
Writes registry values via WMI
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Yara detected Costura Assembly Loader
Yara detected MSILLoadEncryptedAssembly
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 572462 Sample: latest inquiry.vbs Startdate: 15/02/2022 Architecture: WINDOWS Score: 100 72 Multi AV Scanner detection for domain / URL 2->72 74 Found malware configuration 2->74 76 Malicious sample detected (through community Yara rule) 2->76 78 7 other signatures 2->78 8 wscript.exe 14 2->8         started        12 wscript.exe 2->12         started        14 wscript.exe 13 2->14         started        process3 dnsIp4 62 kastex.me 192.185.199.45, 49751, 49754, 49755 UNIFIEDLAYER-AS-1US United States 8->62 80 System process connects to network (likely due to code injection or exploit) 8->80 82 Wscript starts Powershell (via cmd or directly) 8->82 84 Very long command line found 8->84 86 2 other signatures 8->86 16 powershell.exe 14 20 8->16         started        20 cmd.exe 3 8->20         started        23 powershell.exe 12->23         started        25 powershell.exe 14->25         started        signatures5 process6 dnsIp7 54 www.srbizasrbe.org 16->54 56 srbizasrbe.org 37.48.104.198, 443, 49756, 49757 LEASEWEB-NL-AMS-01NetherlandsNL Netherlands 16->56 66 Writes to foreign memory regions 16->66 68 Injects a PE file into a foreign processes 16->68 27 RegAsm.exe 2 2 16->27         started        31 conhost.exe 16->31         started        52 C:\Users\user\Music\latest inquiry.vbs, ASCII 20->52 dropped 70 Command shell drops VBS files 20->70 33 conhost.exe 20->33         started        58 www.srbizasrbe.org 23->58 35 conhost.exe 23->35         started        37 RegAsm.exe 23->37         started        39 RegAsm.exe 23->39         started        60 www.srbizasrbe.org 25->60 41 conhost.exe 25->41         started        43 RegAsm.exe 25->43         started        file8 signatures9 process10 dnsIp11 64 rambolastblood.ddns.net 194.5.98.48, 49770, 49771, 49772 DANILENKODE Netherlands 27->64 88 Contains functionality to steal Chrome passwords or cookies 27->88 90 Contains functionality to inject code into remote processes 27->90 92 Contains functionality to steal Firefox passwords or cookies 27->92 94 3 other signatures 27->94 45 RegAsm.exe 1 27->45         started        48 RegAsm.exe 27->48         started        50 RegAsm.exe 27->50         started        signatures12 process13 signatures14 96 Tries to steal Instant Messenger accounts or passwords 45->96
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7b5f70276fe64b0ec64ff186af6706b1dbbf2e2dc69e4b1546745b293121116f/
Threat name:
Script-WScript.Downloader.Tnega
Create hunting rule
Status:
Malicious
First seen:
2022-02-14 22:05:25 UTC
File Type:
Text (VBS)
AV detection:
11 of 27 (40.74%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pnpxaj3p4zfq5rsp6gdk6zygwhn36lrny2pewfkgornssmjbcfxq._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
069e33991bd7de11fd8defd71166ec16592380f263c3c71cd657abfba072cb60
RemcosRAT
09b75cdc3edcad3cc8b1729683a1132506e851c9d7a1d864fc842284822d1ba5
RemcosRAT
12713f7b0402e9a7e16eb224b3eaf6b9dfb5bb4219a76dce6a2814a6f3bfa0f3
RemcosRAT
2226f8096534deb338ab2f14c86861e5f45d02d54e401243f763429aefe6c904
RemcosRAT
3093fc14a0bb06b811cfd1551715b43f74fdbe75b179e27e44f737a2a1c7154c
RemcosRAT
51c2ff5ec011508a2071d7a4272d4391080143fedc2166474d51913753eb8344
RemcosRAT
68834992b1f069c50b69ef70bbac00639957b4918834b3171e9e5d07fd24c388
RemcosRAT
7e4d8c9bfb728060738c6760ef7454c5a5351ea4166216a20679b8628c3585a2
RemcosRAT
a14fcc6851b168544feec2b3889ccff2bf11306f4d420731b471b249a16af089
RemcosRAT
b53db8cda884be522adeb2f293a41fa80fa2522b3c2eedb1ed20841c5a41d716
RemcosRAT
+ 1'959 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:val collection rat
Link:
https://tria.ge/reports/220215-lc2yvsefdm/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Windows directory
Suspicious use of SetThreadContext
Accesses Microsoft Outlook accounts
Checks computer location settings
Blocklisted process makes network request
NirSoft MailPassView
Nirsoft
Remcos
Malware Config
C2 Extraction:
rambolastblood.ddns.net:6327
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7b5f70276fe64b0ec64ff186af6706b1dbbf2e2dc69e4b1546745b293121116f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer
Create hunting rule
Author:ditekSHen
Description:detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Rule name:remcos_rat
Create hunting rule
Author:jeFF0Falltrades
Rule name:REMCOS_RAT_variants
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

Visual Basic Script (vbs) vbs 7b5f70276fe64b0ec64ff186af6706b1dbbf2e2dc69e4b1546745b293121116f

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/241565/

Comments