MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8ef0ab64ef4a050f29808379fa8e9448bca73be60e4944f9d13a9a6880ba33f2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 9


Intelligence 9 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8ef0ab64ef4a050f29808379fa8e9448bca73be60e4944f9d13a9a6880ba33f2
SHA3-384 hash: c8cfaa202bf7b67ee54cb33973e98f0de5175a673eef1325164980cbe2282b241feb724ed20c2d2c99348f93f6c6f0a4
SHA1 hash: 42cde02779b2a68de221cd0e730a35bdd6c1751d
MD5 hash: 570f0516b9d696953e2ab9e4942cff79
humanhash: california-xray-eighteen-twelve
File name:8ef0ab64ef4a050f29808379fa8e9448bca73be60e4944f9d13a9a6880ba33f2
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'638'400 bytes
First seen:2021-03-23 08:51:51 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 95b167cf8bdf19781a997108df444e3e (4 x RemcosRAT)
ssdeep 24576:xQh0unxTfhbQzpjHZDNXVbtMCME6J5aRXHGEzuKX9NzdX8ukER9hrtVeh5:CFhMjHN5MC5RXHfRX3zeHERT
Threatray 1'990 similar samples on MalwareBazaar
TLSH F2758D226E9E4837C06616344C5FA365693ABF003E24865B77F45D4CDF3A790BC292BB
Reporter JAMESWT_WT
Tags:185.158.115.38

Intelligence

File Origin
# of uploads :
1
# of downloads :
133
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
8ef0ab64ef4a050f29808379fa8e9448bca73be60e4944f9d13a9a6880ba33f2
Verdict:
No threats detected
Analysis date:
2021-03-23 08:56:50 UTC
Tags:
installer
Link:
https://app.any.run/tasks/4cb46a45-f411-486e-b640-53b9042b22c2

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/126517/
Detection(s):
PUA.Win.Packer.BorlandCpp-9
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/649604
Signature
Contains functionality to capture and log keystrokes
Contains functionality to inject code into remote processes
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Detected Remcos RAT
Drops executable to a common third party application directory
Hijacks the control flow in another process
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Sigma detected: Remcos
Writes to foreign memory regions
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 373764 Sample: Kiit1DhpG1 Startdate: 23/03/2021 Architecture: WINDOWS Score: 100 28 Malicious sample detected (through community Yara rule) 2->28 30 Multi AV Scanner detection for submitted file 2->30 32 Detected Remcos RAT 2->32 34 2 other signatures 2->34 7 Kiit1DhpG1.exe 2->7         started        process3 signatures4 36 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 7->36 38 Hijacks the control flow in another process 7->38 10 notepad.exe 7->10         started        process5 signatures6 40 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 10->40 42 Hijacks the control flow in another process 10->42 44 Writes to foreign memory regions 10->44 46 Maps a DLL or memory area into another process 10->46 13 cmd.exe 2 10 10->13         started        process7 dnsIp8 26 185.158.115.38, 49727, 49728, 49729 IPSERVER-RU-NETFiordRU Russian Federation 13->26 18 C:\Users\user\AppData\...\libssp-0.dll, PE32 13->18 dropped 20 C:\Users\user\AppData\Local\...\netapi32.dll, PE32 13->20 dropped 22 C:\Users\user\AppData\...\BDSLauncher.exe, PE32 13->22 dropped 24 C:\Users\user\AppData\...\vervault.exe, PE32 13->24 dropped 48 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 13->48 50 Contains functionality to steal Chrome passwords or cookies 13->50 52 Contains functionality to capture and log keystrokes 13->52 54 3 other signatures 13->54 file9 signatures10
Detection:
remcos
Create hunting rule
Link:
https://mwdb.cert.pl/sample/8ef0ab64ef4a050f29808379fa8e9448bca73be60e4944f9d13a9a6880ba33f2/
Threat name:
Win32.Downloader.Penguish
Create hunting rule
Status:
Malicious
First seen:
2021-03-19 01:16:09 UTC
File Type:
PE (Exe)
Extracted files:
140
AV detection:
16 of 28 (57.14%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=r3ykwzhpjicq6kmaqn47vduujc6koo7gbzeuj6orhkngraf2gpza._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
0953e54968ca9407a172c0a35a00d8b30ec603770809bbd2901a070e1b83b7f8
RemcosRAT
11f06223417d6045acaa15cf7f5515d9afdfc23590c9cd021c2ae90a736bb6cd
RemcosRAT
411e56b415d4c23a741958c3f1ada72b3e958c078d27c339678bb690b7a895c3
RemcosRAT
67b662f28ef6c6a148443ebece272e63e7eeb9d366032b4366fe459b7c5c41f8
RemcosRAT
6c131f342e8226706ba1b39cc955852b022130c14ea12bd3b3cf340bbea25bf6
RemcosRAT
9a55287be3d6c8a74a0aa6ee3a5ea4e288ba968e44c271c9ea5d2293c8300d07
RemcosRAT
b8ae844621bf21969ca7070937f91101ca4f7277917979ad9d4a4ac43d6e5fad
RemcosRAT
e3670bfc1db6fb7223bb6b231ef4c3afd9d34de1d8f87b7a8e7a4cb27cfaa37d
RemcosRAT
ebb6267e5c3bf10ec8ccba29d6fd2c7b747cef8b758db1544caf9edc7f117d7b
RemcosRAT
f39b9e8c4a9aa6d8cd9f069e8a8ee81a3f666e07071f2b4673aa42633026736c
RemcosRAT
+ 1'980 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/210323-lkktw2hj1s/
Unpacked files
SH256 hash:
c7fbdc61eb62c05e40295617e2db75877672931f751a770d2629e6eab6075f2c
MD5 hash:
abf6c724b20844d5b0073988a58faf1e
SHA1 hash:
7a8269d5b2ae623f8148ce9863f48f7e12ce036b
Link:
https://www.unpac.me/results/f5b1c196-0d60-43e4-bd28-f0c60f9624bf/
SH256 hash:
8ef0ab64ef4a050f29808379fa8e9448bca73be60e4944f9d13a9a6880ba33f2
MD5 hash:
570f0516b9d696953e2ab9e4942cff79
SHA1 hash:
42cde02779b2a68de221cd0e730a35bdd6c1751d
Link:
https://www.unpac.me/results/f5b1c196-0d60-43e4-bd28-f0c60f9624bf/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8ef0ab64ef4a050f29808379fa8e9448bca73be60e4944f9d13a9a6880ba33f2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:crime_win32_parallax_payload_1
Create hunting rule
Author:@VK_Intel
Description:Detects Parallax Injected Payload v1.01
Reference:https://twitter.com/VK_Intel/status/1227976106227224578
Rule name:crime_win32_rat_parralax_shell_bin
Create hunting rule
Author:@VK_Intel
Description:Detects Parallax injected code
Reference:https://twitter.com/VK_Intel/status/1257714191902937088
Rule name:MAL_crime_win32_rat_parallax_shell_bin
Create hunting rule
Author:@VK_Intel
Description:Detects Parallax injected code
Reference:https://twitter.com/VK_Intel/status/1257714191902937088

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/126517/

Comments