MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8038ff6a41673eb151cdb7f03872c741dc762834c856d70030cd54af744e36a4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemcosRAT

Vendor detections: 17

Intelligence 17 IOCs YARA 4 File information Comments

SHA256 hash:	8038ff6a41673eb151cdb7f03872c741dc762834c856d70030cd54af744e36a4
SHA3-384 hash:	84338d040af9a3b39b83eea2ea3e3befc681d0664e2dd66d90ec9c3f18fcc50d51d82efd2b19cf6ce20987e0a40c1c0e
SHA1 hash:	977f8407a7033b20b96fec686e918c177160ae92
MD5 hash:	821cd5ef8d94deeeee5b7cb82379c212
humanhash:	mars-blossom-zulu-pennsylvania
File name:	advancePayment-pdf.exe
Download:	download sample
Signature	RemcosRAT Create hunting rule
File size:	549'888 bytes
First seen:	2024-11-11 07:58:51 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	618f8b789fbe1ba0f63925994447c3ef (5 x Stealc, 1 x RemcosRAT)
ssdeep	12288:kEaf/xmwKOsmya7IQVPl55z0AdmSg4MXu3KYPH:kEafZ7HyaEQVFz0AdmSg4ku3KYP
Threatray	10 similar samples on MalwareBazaar
TLSH	T1D4C4CF82A5E02466F7BF4A3D5E3BD6D42A2FB9635E78735C2114261F0AB10E2D52370F
TrID	67.1% (.CPL) Windows Control Panel Item (generic) (57583/11/19) 12.2% (.EXE) Win64 Executable (generic) (10522/11/4) 5.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 5.2% (.EXE) Win32 Executable (generic) (4504/4/1) 2.4% (.ICL) Windows Icons Library (generic) (2059/9)
Magika	pebin
File icon (PE):
dhash icon	a0b09a88aca8c0e8 (1 x RemcosRAT)
Reporter	abuse_ch
Tags:	exe RAT RemcosRAT

Intelligence

File Origin

# of uploads :

# of downloads :

422

Origin country :

Vendor Threat Intelligence

Malware family:

remcos

ID:

File name:

advancePayment-pdf.exe

Verdict:

Malicious activity

Analysis date:

2024-11-11 08:01:58 UTC

Tags:

rat remcos remote

Link:

https://app.any.run/tasks/7646f7ea-c8be-4847-84ec-76ebc9aa9ed3

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

SecuriteInfo.com.Win32.CrypterX-gen.1279.19673.UNOFFICIAL

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6731b97aaf2d3dc89feebe5e

Tags:

underscore cobalt

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Сreating synchronization primitives

Creating a file in the %AppData% subdirectories

Searching for synchronization primitives

Launching the default Windows debugger (dwwin.exe)

Creating a process from a recently created file

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Connection attempt to an infection source

Sending a TCP request to an infection source

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/8038ff6a41673eb151cdb7f03872c741dc762834c856d70030cd54af744e36a4

Malware family:

REMCOS

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/c417a938-9655-4f8d-921d-868fa3812460

Result

Threat name:

Remcos

Detection:

malicious

Classification:

rans.troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1553456

Signature

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to bypass UAC (CMSTPLUA)

Contains functionality to register a low level keyboard hook

Contains functionality to steal Chrome passwords or cookies

Contains functionality to steal Firefox passwords or cookies

Contains functionalty to change the wallpaper

Creates autostart registry keys with suspicious names

Delayed program exit found

Detected Remcos RAT

Detected unpacking (changes PE section rights)

Found malware configuration

Initial sample is a PE file and has a suspicious name

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Remcos

Suricata IDS alerts for network traffic

Yara detected Remcos RAT

Yara detected UAC Bypass using CMSTP

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/8038ff6a41673eb151cdb7f03872c741dc762834c856d70030cd54af744e36a4

Detection:

remcos

Link:

https://mwdb.cert.pl/sample/8038ff6a41673eb151cdb7f03872c741dc762834c856d70030cd54af744e36a4/

Threat name:

Win32.Trojan.StealC

Status:

Malicious

First seen:

2024-11-10 08:36:59 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

24 of 38 (63.16%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=qa4p62sbm47lcuonw7ydq4whihohmkbuzblnoabqzvkk65cog2sa._file

Verdict:

malicious

Label(s):

remcos

shellcode_loader_002

RemcosRAT

0d4bf4e1a47fa2cfdb5cdc23d8a2b1552c1d82c307e1eec95297e62a478d2f2d

RemcosRAT

7a9cf1b27f192c4e65b215b4a126fac4aa8d34397d020568ba4590a15502cf9c

RemcosRAT

8038ff6a41673eb151cdb7f03872c741dc762834c856d70030cd54af744e36a4

RemcosRAT

958e5d7947f48f2047ac3c595ee724a916c9969430731091ac1b9fcfaaf65d70

RemcosRAT

error

RemcosRAT

Result

Malware family:

remcos

Score:

10/10

Tags:

family:remcos botnet:yavakosa discovery persistence rat

Link:

https://tria.ge/reports/241111-jvdmwawclp/

Behaviour

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Program crash

System Location Discovery: System Language Discovery

Adds Run key to start application

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Remcos

Remcos family

Malware Config

C2 Extraction:

198.23.227.212:32583

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/654a955f-788e-4cc3-85d8-4c6c7039f002

Unpacked files

SH256 hash:

7a9cf1b27f192c4e65b215b4a126fac4aa8d34397d020568ba4590a15502cf9c

MD5 hash:

d457d91b513ac2e3a4b539c28537da71

SHA1 hash:

9fd2aca60e95212de7ccc546dd82729b5d050f02

Detections:

Remcos

win_remcos_auto

win_remcos_w0

malware_windows_remcos_rat

INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM

win_remcos_rat_unpacked

Link:

https://www.unpac.me/results/bfc5a8d9-2c03-4cb9-b0e1-16bd6cca3c79/

Parent samples :

7a9cf1b27f192c4e65b215b4a126fac4aa8d34397d020568ba4590a15502cf9c
034b31656266ad9f80490a4fc983ac53bb3224ac88084069080ee2ba0a91fc20
8038ff6a41673eb151cdb7f03872c741dc762834c856d70030cd54af744e36a4
0e184edac45ddeaf7ca4681b65e7b4accafb6705032faf6d2f6a61d2ef6d1ded
ed1416c90a49177106cbea5b7551756e06fee46d77fde4879b8735ec56dd54b4
48773abdad4ef3e8339d4ed2aa02f9d41611e02aefd9e93b0833a2ab99a1619f
4d8f242a1d64b3b41748d2bd56ee6f7119434dedcdf793a83cea95fb31d13347

SH256 hash:

8038ff6a41673eb151cdb7f03872c741dc762834c856d70030cd54af744e36a4

MD5 hash:

821cd5ef8d94deeeee5b7cb82379c212

SHA1 hash:

977f8407a7033b20b96fec686e918c177160ae92

Link:

https://www.unpac.me/results/bfc5a8d9-2c03-4cb9-b0e1-16bd6cca3c79/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/8038ff6a41673eb151cdb7f03872c741dc762834c856d70030cd54af744e36a4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	pe_detect_tls_callbacks Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high
CHECK_NX	Missing Non-Executable Memory Protection	critical
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
WIN32_PROCESS_API	Can Create Process and Threads	KERNEL32.dll::CloseHandle
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess KERNEL32.dll::LoadLibraryW KERNEL32.dll::LoadLibraryA KERNEL32.dll::GetStartupInfoW KERNEL32.dll::GetStartupInfoA KERNEL32.dll::GetCommandLineA
WIN_BASE_EXEC_API	Can Execute other programs	KERNEL32.dll::WriteConsoleOutputCharacterA KERNEL32.dll::WriteConsoleW KERNEL32.dll::WriteConsoleA KERNEL32.dll::SetConsoleCursorPosition KERNEL32.dll::SetStdHandle KERNEL32.dll::GetConsoleAliasA KERNEL32.dll::GetConsoleAliasExesLengthW KERNEL32.dll::GetConsoleFontSize KERNEL32.dll::GetConsoleCP KERNEL32.dll::GetConsoleMode KERNEL32.dll::GetConsoleOutputCP
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::CreateFileA KERNEL32.dll::MoveFileExW KERNEL32.dll::MoveFileA

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample