MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 815926e999fd22862f15ce27e076a2a39b3c92b7c6cbefbc2ff90e22a1b8b20b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 9


Intelligence 9 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 815926e999fd22862f15ce27e076a2a39b3c92b7c6cbefbc2ff90e22a1b8b20b
SHA3-384 hash: 4790e2bf06ab0bb84edae15b7867dd92389c649b2a6f5cbfb5a7a9140020dd0abcc8ad6ec1453e141a224adf75b59015
SHA1 hash: 9e3eb39850f544460238236f1e751f057555fff1
MD5 hash: 958ed66d18b975b77bbdf415fcb25ca5
humanhash: sweet-fillet-tennis-harry
File name:SecuriteInfo.com.Win32.Agent-BDNK.24958.22501
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:4'019'712 bytes
First seen:2023-09-26 07:36:37 UTC
Last seen:2023-09-26 08:21:21 UTC
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 98304:6YZdVAWWlLuKn4mesrQdqSqkxbpYluyPwInJ7M:vglLlrHSfxVYMyPwIJ7M
TLSH T13C1602227682C537D5AE01B0292DE7BF417DBD700BB284DB63C82A1E2E728D15336E57
TrID 80.0% (.MSI) Microsoft Windows Installer (454500/1/170)
10.7% (.MST) Windows SDK Setup Transform script (61000/1/5)
7.8% (.MSP) Windows Installer Patch (44509/10/5)
1.4% (.) Generic OLE2 / Multistream Compound (8000/1)
Reporter SecuriteInfoCom
Tags:89-23-100-222 msi remcos RemcosRAT

Intelligence

File Origin
# of uploads :
2
# of downloads :
101
Origin country :
FR FR
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/451190/
Detection(s):
SecuriteInfo.com.Win32.Agent-BDNK.24958.22501.UNOFFICIAL
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
control lolbin remote shell32
Link:
https://www.filescan.io/uploads/65128a25f1b40cb0d6228c80/reports/3093da3c-58d7-4e26-a765-4cf661a37078/overview
Verdict:
Suspicious
Labled as:
Malware
Link:
https://www.hybrid-analysis.com/sample/815926e999fd22862f15ce27e076a2a39b3c92b7c6cbefbc2ff90e22a1b8b20b
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/1314323
Signature
Antivirus detection for URL or domain
Bypasses PowerShell execution policy
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1314323 Sample: SecuriteInfo.com.Win32.Agen... Startdate: 26/09/2023 Architecture: WINDOWS Score: 72 46 Antivirus detection for URL or domain 2->46 48 Multi AV Scanner detection for dropped file 2->48 50 Multi AV Scanner detection for submitted file 2->50 9 msiexec.exe 27 47 2->9         started        12 msiexec.exe 2 2->12         started        process3 file4 32 C:\Windows\Installer\MSI650.tmp, PE32 9->32 dropped 34 C:\Windows\Installer\MSI564.tmp, PE32 9->34 dropped 36 C:\Windows\Installer\MSI534.tmp, PE32 9->36 dropped 38 13 other files (6 malicious) 9->38 dropped 14 msiexec.exe 8 9->14         started        18 ICQ.exe 1 9->18         started        process5 file6 40 C:\Users\user\AppData\Local\Temp\scr66D.txt, Unicode 14->40 dropped 42 C:\Users\user\AppData\Local\Temp\scr66C.ps1, Unicode 14->42 dropped 44 C:\Users\user\AppData\Local\Temp\pss67D.ps1, Unicode 14->44 dropped 52 Bypasses PowerShell execution policy 14->52 20 powershell.exe 18 14->20         started        54 Maps a DLL or memory area into another process 18->54 22 cmd.exe 3 18->22         started        signatures7 process8 process9 24 cmd.exe 1 2 20->24         started        26 conhost.exe 20->26         started        28 conhost.exe 22->28         started        process10 30 conhost.exe 24->30         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/815926e999fd22862f15ce27e076a2a39b3c92b7c6cbefbc2ff90e22a1b8b20b/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2023-09-26 06:23:24 UTC
File Type:
Binary (Archive)
Extracted files:
178
AV detection:
8 of 23 (34.78%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qfmsn2mz7urimlyvzyt6a5vcuontzevxy3f67pbp7ehcfinywifq._file
Verdict:
unknown
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:remotehost rat
Link:
https://tria.ge/reports/230926-jftqjsfe4s/
Behaviour
Checks SCSI registry key(s)
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Uses Volume Shadow Copy service COM API
Enumerates physical storage devices
Drops file in Windows directory
Drops file in System32 directory
Suspicious use of SetThreadContext
Enumerates connected drives
Executes dropped EXE
Loads dropped DLL
Remcos
Malware Config
C2 Extraction:
192.210.133.19:4042
Malware family:
Remcos
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/815926e999fd/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Remcos
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/815926e999fd22862f15ce27e076a2a39b3c92b7c6cbefbc2ff90e22a1b8b20b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:maldoc_OLE_file_magic_number
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:suspicious_msi_file
Create hunting rule
Author:Johnk3r
Description:Detects common strings, DLL and API in Banker_BR

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RemcosRAT

Microsoft Software Installer (MSI) msi 815926e999fd22862f15ce27e076a2a39b3c92b7c6cbefbc2ff90e22a1b8b20b

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2713940/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/451190/

Comments