MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8a30ec1b66ef03adde9757a0b8c1fb554bd0a09a9ff5d2486da51a4a1ab7d940. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemcosRAT

Vendor detections: 15

Intelligence 15 IOCs YARA 7 File information Comments 1

SHA256 hash:	8a30ec1b66ef03adde9757a0b8c1fb554bd0a09a9ff5d2486da51a4a1ab7d940
SHA3-384 hash:	3dda8a70ac977119f8457112a145c5887beb2ae35d3877184500f228790d24a989865fc558ca7d31b151b77acdc39bac
SHA1 hash:	1bba6f5a33a58716ab7f5c3321ae910c11b74150
MD5 hash:	cfebcdbcab9867f8db71a375cda8e5b2
humanhash:	jig-jersey-fruit-paris
File name:	cfebcdbcab9867f8db71a375cda8e5b2
Download:	download sample
Signature	RemcosRAT Create hunting rule
File size:	1'046'016 bytes
First seen:	2022-11-05 01:41:14 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'600 x Formbook, 12'241 x SnakeKeylogger)
ssdeep	24576:Ju1Enq8VdWbVmFWOTZztVzChCWm38gQUMGUr:Juqq83GKWOHVzOy8g6GU
TLSH	T12D25231071A7CD69D01903B24AC38055A339BED5E0A7EDCF24C9174E2F76BD69292B3B
TrID	72.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.4% (.EXE) Win64 Executable (generic) (10523/12/4) 6.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.4% (.EXE) Win32 Executable (generic) (4505/5/1) 2.0% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):
dhash icon	ce9c9496e4949c9c (73 x AgentTesla, 51 x SnakeKeylogger, 30 x Formbook)
Reporter	zbetcheckin
Tags:	32 exe RemcosRAT

Intelligence

File Origin

# of uploads :

# of downloads :

179

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

remcos

ID:

File name:

cfebcdbcab9867f8db71a375cda8e5b2

Verdict:

Malicious activity

Analysis date:

2022-11-05 01:44:34 UTC

Tags:

trojan rat remcos keylogger

Link:

https://app.any.run/tasks/46904f5f-173c-45fa-8e2a-72d08445bca1

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Remcos

Link:

https://www.capesandbox.com/analysis/328893/

Detection(s):

SecuriteInfo.com.Trojan.PWS.StealerNET.122-1.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a window

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

packed remcos

Link:

https://www.filescan.io/uploads/6365bf6b143b3ab5f895d372/reports/45431103-95fc-4829-9eeb-bbf08f6c26c3/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

REMCOS

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/1c275092-2d05-475a-9e2a-683f933b0b0a

Result

Threat name:

Remcos

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1105921

Signature

.NET source code contains potential unpacker

C2 URLs / IPs found in malware configuration

Injects a PE file into a foreign processes

Installs a global keyboard hook

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: Remcos

Snort IDS alert for network traffic

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Yara detected AntiVM3

Yara detected Remcos RAT

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/8a30ec1b66ef03adde9757a0b8c1fb554bd0a09a9ff5d2486da51a4a1ab7d940/

Threat name:

ByteCode-MSIL.Trojan.Remcos

Status:

Malicious

First seen:

2022-11-04 12:10:04 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

20 of 41 (48.78%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=riyoyg3g54b23xuxk6qlrqp3kvf5bie2t725esdnuuneugvx3faa._file

Verdict:

malicious

Label(s):

remcos

Result

Malware family:

remcos

Score:

10/10

Tags:

family:remcos botnet:remotehost rat

Link:

https://tria.ge/reports/221105-b4n6zacfh9/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Remcos

Malware Config

C2 Extraction:

mesa67279.sytes.net:9900

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/c261985d-dfd8-442c-a830-74b9813fb1cb

Unpacked files

SH256 hash:

01c7fef900ae94ddfa2158cfa4ea12d8bdc37058b73a4f22f40be0410d72f4db

MD5 hash:

16dc59fb58e113e25fe2d5b37aa179ff

SHA1 hash:

68c2f42d79e0258e2a0ec34375e7d378ad59a50d

Link:

https://www.unpac.me/results/99bea165-857e-498e-bc96-ca363b5982bf/

SH256 hash:

ee37e7edd8770e0f0bfc0e5ef84217d7cb7908100671ca443c29d443c12d55b9

MD5 hash:

e13e2e3e743268b236a1ff37e3c17cc2

SHA1 hash:

56bfd4700398aa305cdee8b415850142bf8c842d

Detections:

Remcos

win_remcos_auto

Link:

https://www.unpac.me/results/99bea165-857e-498e-bc96-ca363b5982bf/

Parent samples :

1c64ec517c691c29d701145d08a3eae4d783b73d6c79aef024ff9d801c54bcd1
7337db69a20a40af35453369ceabe00d6bff13e5ba8199a294f7bad7c0ee007d
2c59459ca6467913297ed13460ee6f5ec2aa85b4824d339a8f9ac01d83b86dea
8a30ec1b66ef03adde9757a0b8c1fb554bd0a09a9ff5d2486da51a4a1ab7d940
a25c4d0ef5afa1991e30cedabbc3d4104dee76cbe92ed788b508a3f595f0ced3
bb1d45eb0cad32a9458ba080b0fd48cc19f0170002cd0f1a62adf644106e4563
f7f7a09c83f4a5ae327e02aa2eacc52ec0460d3f7dc8fc60c13039f14c9a539f
3b6230848d1a806ee90954b3e2a6ccaf020ed90d91eb29f231badf12cebf0dcf
4071b98e8bf44161cebf8c60bf244913ecab7144f97500ff285445f29d6045c6

SH256 hash:

cfc16a2dbb933b1b85807d48966e9301b9fc34f4c44e7357713ca88b54bf4ab4

MD5 hash:

aabd0bdc81026ade6c57383f21d5c227

SHA1 hash:

4b26936bb8c03be6d7963184215a5ab594ecb765

Link:

https://www.unpac.me/results/99bea165-857e-498e-bc96-ca363b5982bf/

SH256 hash:

8354a7ad0499febdd288542828ad0355dcb7054c0c518266208e571c5122b0c6

MD5 hash:

6bfc7ce9ec7891d9d8494454332099b5

SHA1 hash:

34fc8cebba035e2cc6d27d636f9655949080bf8e

Link:

https://www.unpac.me/results/99bea165-857e-498e-bc96-ca363b5982bf/

SH256 hash:

6650beecf418674c93304be0d15514fd27b56a690246e42a93a3b7a914e5a35e

MD5 hash:

63fdee6d2b83f382ef91d17d828b5678

SHA1 hash:

20e4cc5865f131afd9d0e080cd6e048059618e34

Link:

https://www.unpac.me/results/99bea165-857e-498e-bc96-ca363b5982bf/

SH256 hash:

8a30ec1b66ef03adde9757a0b8c1fb554bd0a09a9ff5d2486da51a4a1ab7d940

MD5 hash:

cfebcdbcab9867f8db71a375cda8e5b2

SHA1 hash:

1bba6f5a33a58716ab7f5c3321ae910c11b74150

Link:

https://www.unpac.me/results/99bea165-857e-498e-bc96-ca363b5982bf/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/8a30ec1b66ef/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/8a30ec1b66ef03adde9757a0b8c1fb554bd0a09a9ff5d2486da51a4a1ab7d940

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer Create hunting rule
Author:	ditekSHen
Description:	detects Windows exceutables potentially bypassing UAC using eventvwr.exe

Rule name:	pe_imphash Create hunting rule

Rule name:	Remcos Create hunting rule
Author:	kevoreilly
Description:	Remcos Payload

Rule name:	REMCOS_RAT_variants Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Windows_Trojan_Remcos_b296e965 Create hunting rule
Author:	Elastic Security

Rule name:	win_remcos_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	Detects win.remcos.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RemcosRAT

exe 8a30ec1b66ef03adde9757a0b8c1fb554bd0a09a9ff5d2486da51a4a1ab7d940

(this sample)

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/2260834/

Cape

https://www.capesandbox.com/analysis/328893/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

zbet commented on 2022-11-05 01:41:23 UTC

url : hxxp://208.67.105.179/plugmanzx.exe