MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 853d1454bed159a0f556534ad5ab874da6294076696b5cdd263dc540268c1314. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 7


Intelligence 7 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 853d1454bed159a0f556534ad5ab874da6294076696b5cdd263dc540268c1314
SHA3-384 hash: ccacd812c8b30f1e73ac0c6c0fba8b11b07e4308822ed1d340fcdb699623cf13f699780724f585d82dc311d5af90a1ef
SHA1 hash: 1e5d8eed00fb3a10264a71a11c8a0693ee53ca1d
MD5 hash: a057532f12d60240a18d9281c8d6f0be
humanhash: jupiter-autumn-edward-diet
File name:853d1454bed159a0f556534ad5ab874da6294076696b5cdd263dc540268c1314
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:3'725'536 bytes
First seen:2021-03-23 08:07:53 UTC
Last seen:2021-03-23 09:35:50 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash d48321d87abfa9abd4549f53fa4cac20 (1 x RemcosRAT)
ssdeep 24576:sptR8zj3FUa2WxjVK9aNevU9o1BiZSN+oU+OQKVpHDeHJ/iq5YiZpfCfAcl+Bs1Q:416SkKSHtqEDe8KsUZxET1AXYiLEm
Threatray 85 similar samples on MalwareBazaar
TLSH 09068D21B344503FC16B0F3A547BA6659E3EBF6036128D5B57F05C8C8FB65813A3A29B
Reporter JAMESWT_WT
Tags:RemcosRAT TORG-ALYANS LLC

Intelligence

File Origin
# of uploads :
2
# of downloads :
129
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
853d1454bed159a0f556534ad5ab874da6294076696b5cdd263dc540268c1314
Verdict:
No threats detected
Analysis date:
2021-03-23 08:15:30 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/937a95e0-82b4-42ea-b2ec-5e750c9006d1

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/126457/
Detection(s):
PUA.Win.Packer.Exe-6
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Launching the default Windows debugger (dwwin.exe)
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/649533
Signature
Allocates memory in foreign processes
Contains functionality to capture and log keystrokes
Contains functionality to inject code into remote processes
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Detected Remcos RAT
Drops executable to a common third party application directory
Hijacks the control flow in another process
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Sigma detected: Remcos
Writes to foreign memory regions
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 373729 Sample: JjbRa9a3wq Startdate: 23/03/2021 Architecture: WINDOWS Score: 100 24 Malicious sample detected (through community Yara rule) 2->24 26 Multi AV Scanner detection for submitted file 2->26 28 Detected Remcos RAT 2->28 30 2 other signatures 2->30 7 JjbRa9a3wq.exe 2->7         started        process3 signatures4 32 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 7->32 34 Hijacks the control flow in another process 7->34 36 Writes to foreign memory regions 7->36 38 Allocates memory in foreign processes 7->38 10 notepad.exe 7->10         started        process5 signatures6 40 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 10->40 42 Hijacks the control flow in another process 10->42 44 Writes to foreign memory regions 10->44 46 Maps a DLL or memory area into another process 10->46 13 cmd.exe 2 6 10->13         started        process7 dnsIp8 22 37.59.51.125, 49769, 49771, 49772 OVHFR France 13->22 18 C:\Users\user\AppData\Roaming\...\wlms.exe, PE32 13->18 dropped 20 C:\Users\user\AppData\...\libcrypto-1_1.dll, PE32 13->20 dropped 48 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 13->48 50 Contains functionality to steal Chrome passwords or cookies 13->50 52 Contains functionality to capture and log keystrokes 13->52 54 3 other signatures 13->54 file9 signatures10
Detection:
remcos
Create hunting rule
Link:
https://mwdb.cert.pl/sample/853d1454bed159a0f556534ad5ab874da6294076696b5cdd263dc540268c1314/
Threat name:
Win32.Downloader.Penguish
Create hunting rule
Status:
Malicious
First seen:
2021-02-09 01:05:23 UTC
File Type:
PE (Exe)
Extracted files:
46
AV detection:
21 of 29 (72.41%)
Threat level:
  3/5
Verdict:
malicious
Similar samples:
00a43037570aef0f977589fa679bf79627d04890fabfca6c19ae2c2f851ef289
RemcosRAT
0758013f642af55d429e3688886f60ed90633a19d87173c2488de6468599456c
RemcosRAT
0fa5f308271acceabd13e15871b230e030550825e17bdd0b3b1e53724ca5abd6
RemcosRAT
6624ce134dd16a37d6615483002f24b74c74c55b45259bc5408b7ae804d0fe22
RemcosRAT
8ef0ab64ef4a050f29808379fa8e9448bca73be60e4944f9d13a9a6880ba33f2
RemcosRAT
98d8bbdf43367821e74fd0c26f5bdda07fe9a750476cce1bb0df88c5aa18b745
RemcosRAT
a144d424d0ace63551d67ee67efe8ff6242df2b5c55d8f2494e0731f2d88f711
RemcosRAT
a23d7dbeadcc55d6304114a633d5b65764aabfc590a65e12d837a0c108cae1c5
RemcosRAT
b9a23ce0f2e5309363143d5a659731015c710a0b834060f8ad0194a06d48ee01
RemcosRAT
e7a6e48e93a3d286568161e52e0aaeb945de463505fdc572012148272b6b41ec
RemcosRAT
+ 75 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/210323-1xqqg6lqpe/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Program crash
Unpacked files
SH256 hash:
c7fbdc61eb62c05e40295617e2db75877672931f751a770d2629e6eab6075f2c
MD5 hash:
abf6c724b20844d5b0073988a58faf1e
SHA1 hash:
7a8269d5b2ae623f8148ce9863f48f7e12ce036b
Link:
https://www.unpac.me/results/d1018afb-6ade-4bf2-b3a2-0543764f0188/
SH256 hash:
853d1454bed159a0f556534ad5ab874da6294076696b5cdd263dc540268c1314
MD5 hash:
a057532f12d60240a18d9281c8d6f0be
SHA1 hash:
1e5d8eed00fb3a10264a71a11c8a0693ee53ca1d
Link:
https://www.unpac.me/results/d1018afb-6ade-4bf2-b3a2-0543764f0188/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/853d1454bed159a0f556534ad5ab874da6294076696b5cdd263dc540268c1314

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:crime_win32_parallax_payload_1
Create hunting rule
Author:@VK_Intel
Description:Detects Parallax Injected Payload v1.01
Reference:https://twitter.com/VK_Intel/status/1227976106227224578
Rule name:crime_win32_rat_parralax_shell_bin
Create hunting rule
Author:@VK_Intel
Description:Detects Parallax injected code
Reference:https://twitter.com/VK_Intel/status/1257714191902937088
Rule name:MAL_crime_win32_rat_parallax_shell_bin
Create hunting rule
Author:@VK_Intel
Description:Detects Parallax injected code
Reference:https://twitter.com/VK_Intel/status/1257714191902937088

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/126457/

Comments