MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 86d7d44cb646ec00405535763058309e34ac9c0ec5c471423e2cbc90371294f2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 16


Intelligence 16 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 86d7d44cb646ec00405535763058309e34ac9c0ec5c471423e2cbc90371294f2
SHA3-384 hash: 5eb870a0647e735019bb1f6ee31a8632aadafc3603fa9988632e72ee1aa6f5c3ccd9424fa0b0ceb9f03e32b35927b7c7
SHA1 hash: ad4394e4a1db97aeccdc10db1ac343f3a3e5e76a
MD5 hash: cdacf4a3067fe614adceacb0a2ca3a03
humanhash: stream-mockingbird-east-louisiana
File name:GWC-VNGI-240727 NEW PO.exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:882'688 bytes
First seen:2024-08-01 06:40:21 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 21371b611d91188d602926b15db6bd48 (70 x Formbook, 37 x AgentTesla, 20 x RemcosRAT)
ssdeep 24576:eiUmSB/o5d1ubcvB0UbE26zCi9KvC98j2T90M/mW:e/mU/ohubcvB2Rwo8qD
Threatray 4'313 similar samples on MalwareBazaar
TLSH T146152356E6C0EC69C26203BC98B9CEB209B17530CFD82B7E9750F61A5871353D417BAB
TrID 39.1% (.EXE) UPX compressed Win32 Executable (27066/9/6)
38.3% (.EXE) Win32 EXE Yoda's Crypter (26569/9/4)
7.2% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.5% (.EXE) Win32 Executable (generic) (4504/4/1)
2.9% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon aae2f3e38383b629 (2'034 x Formbook, 1'183 x CredentialFlusher, 666 x AgentTesla)
Reporter abuse_ch
Tags:exe RemcosRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
354
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
GWC-VNGI-240727 NEW PO.exe
Verdict:
Malicious activity
Analysis date:
2024-08-01 07:06:45 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/ec76f223-bbce-49f4-b0c1-2eefb43f6c0b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Clean
Score:
89.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=66ab2e07037b02d0daecdd37
Tags:
s h e l l c o d e c r y p t e r
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% directory
Restart of the analyzed sample
Сreating synchronization primitives
Creating a file in the %AppData% subdirectories
Creating a process from a recently created file
Connection attempt
Launching a process
Sending a custom TCP request
DNS request
Launching the default Windows debugger (dwwin.exe)
Creating a file
Creating a file in the %AppData% directory
Reading critical registry keys
Creating a file in the Windows subdirectories
Enabling the 'hidden' option for recently created files
Searching for the window
Unauthorized injection to a recently created process
Unauthorized injection to a recently created process by context flags manipulation
Stealing user critical data
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a system process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
autoit lolbin microsoft_visual_cc packed packed packed shell32 upx
Link:
https://www.filescan.io/uploads/66ab2e034c5c17942a8119e4/reports/628d2ad3-588d-4409-a2d5-9e4c08677d01/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/86d7d44cb646ec00405535763058309e34ac9c0ec5c471423e2cbc90371294f2
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/e44b65a0-aee0-43fa-a544-90b3ae5a6366
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1485817
Signature
AI detected suspicious sample
Binary is likely a compiled AutoIt script file
C2 URLs / IPs found in malware configuration
Found API chain indicative of sandbox detection
Found malware configuration
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Yara detected Remcos RAT
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1485817 Sample: GWC-VNGI-240727 NEW PO.exe Startdate: 01/08/2024 Architecture: WINDOWS Score: 100 48 Multi AV Scanner detection for domain / URL 2->48 50 Found malware configuration 2->50 52 Malicious sample detected (through community Yara rule) 2->52 54 8 other signatures 2->54 14 GWC-VNGI-240727 NEW PO.exe 4 2->14         started        process3 signatures4 70 Binary is likely a compiled AutoIt script file 14->70 17 GWC-VNGI-240727 NEW PO.exe 2 14->17         started        process5 signatures6 46 Binary is likely a compiled AutoIt script file 17->46 20 GWC-VNGI-240727 NEW PO.exe 2 17->20         started        process7 signatures8 58 Binary is likely a compiled AutoIt script file 20->58 23 GWC-VNGI-240727 NEW PO.exe 2 20->23         started        process9 signatures10 62 Binary is likely a compiled AutoIt script file 23->62 26 GWC-VNGI-240727 NEW PO.exe 2 23->26         started        process11 signatures12 66 Binary is likely a compiled AutoIt script file 26->66 29 GWC-VNGI-240727 NEW PO.exe 2 26->29         started        process13 signatures14 68 Binary is likely a compiled AutoIt script file 29->68 32 GWC-VNGI-240727 NEW PO.exe 2 29->32         started        process15 signatures16 44 Binary is likely a compiled AutoIt script file 32->44 35 GWC-VNGI-240727 NEW PO.exe 2 32->35         started        process17 signatures18 56 Binary is likely a compiled AutoIt script file 35->56 38 GWC-VNGI-240727 NEW PO.exe 2 35->38         started        process19 signatures20 60 Binary is likely a compiled AutoIt script file 38->60 41 GWC-VNGI-240727 NEW PO.exe 2 38->41         started        process21 signatures22 64 Binary is likely a compiled AutoIt script file 41->64
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/86d7d44cb646ec00405535763058309e34ac9c0ec5c471423e2cbc90371294f2
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/86d7d44cb646ec00405535763058309e34ac9c0ec5c471423e2cbc90371294f2/
Threat name:
Win32.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2024-07-25 04:15:24 UTC
File Type:
PE (Exe)
Extracted files:
52
AV detection:
17 of 24 (70.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=q3l5itfwi3waaqcvgv3dawbqty2kzhaoyxchcqr6fs6janysstza._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
0280cde4a65664a05361129dc1cfa10bc17b3fa9567103ce6eb9d07b06f8f160
RemcosRAT
5e227c08361efd95e0ee576fed034bad2ea5d286fa9ea3d2d3cc221fa75b19cb
RemcosRAT
769c980466c1f15df3df8bc55967d5b14dfdcbc4a5a6e32503efef660b5f5120
RemcosRAT
d0709726302c534fb5d23e22fb7cb28e8350164cb5b41b7c12f60268f01a61d3
RemcosRAT
d1d2afe21465d8387627e5721bd2fdbb77e910282074d8ad47bb59abd4550bfb
RemcosRAT
fdd56eff190fb7974b5432cafd9f0071049c37c853f229ffb69400e9687f49ab
RemcosRAT
+ 4'303 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:new riches discovery persistence rat upx
Link:
https://tria.ge/reports/240801-hfr2aaxbrq/
Behaviour
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
AutoIT Executable
Adds Run key to start application
Checks computer location settings
Executes dropped EXE
UPX packed file
Remcos
Malware Config
C2 Extraction:
75.127.7.188:2404
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/724bad3e-46a5-4f22-a7f8-1e21bcbcc725
Unpacked files
SH256 hash:
ab40fffacf5eccbef1d431be60d71c728b314e246e75f6bff0d9a49d35c821d1
MD5 hash:
654e1f0d4c93cbf9da5752b3b408c587
SHA1 hash:
bf5a4103e390a34753f9f94a20f17244d93f1a47
Detections:
Remcos
Create hunting rule
win_remcos_auto
Create hunting rule
win_remcos_w0
Create hunting rule
malware_windows_remcos_rat
Create hunting rule
Link:
https://www.unpac.me/results/c107cf74-4991-4fa8-bc19-dc4a1bcf4e2e/
Parent samples :
ff6803eaecf99b28c820bd16c0fb32875395427cf8575cea7f8ff39c8fdfefa3
86d7d44cb646ec00405535763058309e34ac9c0ec5c471423e2cbc90371294f2
SH256 hash:
0742487dc863bfea31fc19cba65f5315498ee6eaca1f80a09f9728c522b5230c
MD5 hash:
370de292d302ccf40de62d6387ad910d
SHA1 hash:
c6ef3d5581e63165eafd160bc69779f0a29cd56b
Detections:
AutoIT_Compiled
Create hunting rule
Link:
https://www.unpac.me/results/c107cf74-4991-4fa8-bc19-dc4a1bcf4e2e/
SH256 hash:
86d7d44cb646ec00405535763058309e34ac9c0ec5c471423e2cbc90371294f2
MD5 hash:
cdacf4a3067fe614adceacb0a2ca3a03
SHA1 hash:
ad4394e4a1db97aeccdc10db1ac343f3a3e5e76a
Link:
https://www.unpac.me/results/c107cf74-4991-4fa8-bc19-dc4a1bcf4e2e/
Malware family:
Remcos
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/86d7d44cb646/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.81
Link:
https://yomi.yoroi.company/submissions/86d7d44cb646ec00405535763058309e34ac9c0ec5c471423e2cbc90371294f2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser
Create hunting rule
Author:malware-lu
Rule name:upx_largefile
Create hunting rule
Author:k3nr9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_NXMissing Non-Executable Memory Protectioncritical
Reviews
IDCapabilitiesEvidence
AUTH_APIManipulates User AuthorizationADVAPI32.dll::GetAce
MULTIMEDIA_APICan Play MultimediaWINMM.dll::timeGetTime
WIN_BASE_APIUses Win Base APIKERNEL32.DLL::LoadLibraryA

Comments