MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 85a36abfb96a5f4e13125a67a0b63c951afc7530c019edd0dffba827f92fea6c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 12


Intelligence 12 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 85a36abfb96a5f4e13125a67a0b63c951afc7530c019edd0dffba827f92fea6c
SHA3-384 hash: 5542a2145fd819cd38b3e139cc31563814a8cf99631868a5064114e10f7ae5a1bc063ecb6802693594767af2918e6d7f
SHA1 hash: 746bef4a6f645cf16faba41bb9635a0d9b7d6eee
MD5 hash: 0b7de5ae22b768e277f8d6be97291ce0
humanhash: delaware-march-five-xray
File name:18446.exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:361'768 bytes
First seen:2023-05-24 11:03:35 UTC
Last seen:2023-05-24 11:45:26 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash b78ecf47c0a3e24a6f4af114e2d1f5de (300 x GuLoader, 23 x Formbook, 21 x RemcosRAT)
ssdeep 6144:syI2f9MbYEyhnWFCEsW6aSTOeTMHKNNm3SbHSl9z1iwFD4lSlULWrsDcbKp:tf9MbYdxXYSy+NNm3S+l9wwFTlULWrUP
Threatray 804 similar samples on MalwareBazaar
TLSH T13974230533B16CBBD55329324BB5A73BD335E2141AB16AF76FB21A5B0C7234189392CB
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon f8a48686aeb6f3e0 (4 x Formbook, 2 x RemcosRAT, 1 x AgentTesla)
Reporter Neiki
Tags:RemcosRAT signed

Code Signing Certificate

Organisation:
Issuer:
Algorithm:sha256WithRSAEncryption
Valid from:2022-09-20T07:40:16Z
Valid to:2025-09-19T07:40:16Z
Serial number: 1d8c7da5fe7e9c27eb867efd6bd33c5b384df022
Thumbprint Algorithm:SHA256
Thumbprint: 469383329296947bf463723813936f49a833cefdeb1cb265f9f9b348d6ea0819
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
2
# of downloads :
116
Origin country :
DE DE
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
2024424 order shipment.docx
Verdict:
Malicious activity
Analysis date:
2023-05-24 10:08:41 UTC
Tags:
opendir exploit cve-2017-11882 loader
Link:
https://app.any.run/tasks/b9019338-5c31-47b2-9511-037c77aa7e34

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/391135/
Detection(s):
SecuriteInfo.com.Gen.Variant.Nemesis.23650.29128.14624.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Creating a file
Creating a file in the %temp% subdirectories
Sending a custom TCP request
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/87719/overview
Behaviour
MalwareBazaar
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
buer lolbin overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/646def2274f29291dfe64060/reports/9a63169a-4984-4c75-a5e5-4fda6fa47e2d/overview
Verdict:
Malicious
Labled as:
Backdoor.Androm
Link:
https://www.hybrid-analysis.com/sample/85a36abfb96a5f4e13125a67a0b63c951afc7530c019edd0dffba827f92fea6c
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/c4601586-ff63-4174-92ca-5f7966fcaf26
Result
Threat name:
GuLoader, Remcos
Create hunting rule
Detection:
malicious
Classification:
troj.evad.spyw
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1241544
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Installs a global keyboard hook
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Sigma detected: Remcos
Snort IDS alert for network traffic
Tries to detect Any.run
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses dynamic DNS services
Yara detected GuLoader
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/85a36abfb96a5f4e13125a67a0b63c951afc7530c019edd0dffba827f92fea6c/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2023-05-24 04:42:31 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
9 of 23 (39.13%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qwrwvp5znjpu4eysljt2bnr4sunpy5jqyam63ug77oucp6jp5jwa._file
Verdict:
unknown
Similar samples:
0046d4926a496ea3554ee394b36f77d7ba5f615718bd73b9139f9622d1e11018
RemcosRAT
26e297f8f4bf5837af4c8b5132598c2eed45245c4f6baf0e8c960ff2a555989e
RemcosRAT
63cd38e88915fce6ee48a8a9d658fad5c83624e2db415a4c151e84ad9a1af457
RemcosRAT
6856d48b94e263e7add9845cdb9077a9bfeb01f6e35f1a1bcacaf5ecba2f6a86
RemcosRAT
693e8f8b588610bfc9ed0592d7ec7486d0b039cc0651a710c642c1f19c0037d1
RemcosRAT
723ff97e6559f6558c288ca693898592a21aab28c003883ca13b81667d7e3aef
RemcosRAT
b534709b0de0c4392af03fea261580b08915ae1e5a55496f85dc21500c6a8338
RemcosRAT
baf524e165268a0c661800a1f01547c21f6bb1c0d399c72ebbcd2a08cc797977
RemcosRAT
f8082dc1210616c55008edc73e1ca4966cd8575e2425ed72f71f28b97f71172a
RemcosRAT
+ 794 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:remotehost discovery rat
Link:
https://tria.ge/reports/230524-m59d3scb39/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Windows directory
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Checks installed software on the system
Checks QEMU agent file
Loads dropped DLL
Remcos
Malware Config
C2 Extraction:
divdemoce.duckdns.org:35639
Unpacked files
SH256 hash:
fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e
MD5 hash:
3f176d1ee13b0d7d6bd92e1c7a0b9bae
SHA1 hash:
fe582246792774c2c9dd15639ffa0aca90d6fd0b
Link:
https://www.unpac.me/results/926fb1a4-0448-46c2-a6a6-523621634185/
SH256 hash:
85a36abfb96a5f4e13125a67a0b63c951afc7530c019edd0dffba827f92fea6c
MD5 hash:
0b7de5ae22b768e277f8d6be97291ce0
SHA1 hash:
746bef4a6f645cf16faba41bb9635a0d9b7d6eee
Link:
https://www.unpac.me/results/926fb1a4-0448-46c2-a6a6-523621634185/
Malware family:
Remcos
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/85a36abfb96a/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Remcos
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/85a36abfb96a5f4e13125a67a0b63c951afc7530c019edd0dffba827f92fea6c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Ins_NSIS_Buer_Nov_2020_1
Create hunting rule
Author:Arkbird_SOLG
Description:Detect NSIS installer used for Buer loader
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RemcosRAT

Executable exe 85a36abfb96a5f4e13125a67a0b63c951afc7530c019edd0dffba827f92fea6c

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/391135/
  
URLhaus
https://urlhaus.abuse.ch/url/2640036/
  
Delivery method
Distributed via web download

Comments