🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8f4cb3b0aaf0bdbbcc6d080385fab14ae0cf71d8e46770902ade7f5e4099b5da. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 12


Maldoc score: 4


Intelligence 12 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8f4cb3b0aaf0bdbbcc6d080385fab14ae0cf71d8e46770902ade7f5e4099b5da
SHA3-384 hash: 456c85f93a4d3904b79615f208306f263640fd741d2a313b14e218f7a7178672265f650e12b4f6d5e3a6b7f206194095
SHA1 hash: f5e0e6247b2fd7ec74fc687ba0f63d8c05cc3fe0
MD5 hash: fb16f7b0fbcb2ae5d3b185392e4543a5
humanhash: nineteen-cup-uncle-india
File name:0001.xls
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'227'776 bytes
First seen:2024-10-29 15:27:54 UTC
Last seen:2024-10-29 17:24:33 UTC
File type:Excel file xls
MIME type:application/vnd.ms-excel
ssdeep 24576:G1852p5l2JsykgMpRptnPskUcZnujf9VYdHk5Xqx5Q:G1O2p5l2oFpB0kUcIf9naT
TLSH T1E0452341F98ADB0AEA537A3916A88B410B2CFD40BF15D4A77897331D99B6D7043C73AC
TrID 46.5% (.XLS) Microsoft Excel sheet (alternate) (56500/1/4)
26.7% (.XLS) Microsoft Excel sheet (32500/1/3)
20.1% (.XLS) Microsoft Excel sheet (alternate) (24500/1/2)
6.5% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika xls
Reporter Racco42
Tags:cve-2017-0199 RemcosRAT xls

Office OLE Information

This malware samples appears to be an Office document. The following table provides more information about this document using oletools and oledump.

OLE id
Maldoc score: 4
OLE dump

MalwareBazaar was able to identify 15 sections in this file using oledump:

Section IDSection sizeSection name
1114 bytesCompObj
2244 bytesDocumentSummaryInformation
3200 bytesSummaryInformation
499 bytesMBD00D6412A/CompObj
5872415 bytesMBD00D6412A/Package
6488 bytesMBD00D6412B/Ole
7331654 bytesWorkbook
8525 bytes_VBA_PROJECT_CUR/PROJECT
9104 bytes_VBA_PROJECT_CUR/PROJECTwm
10977 bytes_VBA_PROJECT_CUR/VBA/Sheet1
11977 bytes_VBA_PROJECT_CUR/VBA/Sheet2
12977 bytes_VBA_PROJECT_CUR/VBA/Sheet3
13985 bytes_VBA_PROJECT_CUR/VBA/ThisWorkbook
142644 bytes_VBA_PROJECT_CUR/VBA/_VBA_PROJECT
15553 bytes_VBA_PROJECT_CUR/VBA/dir
OLE vba

MalwareBazaar was able to extract and deobfuscate VBA script(s) the following information from OLE objects embedded in this file using olevba:

TypeKeywordDescription
SuspiciousHex StringsHex-encoded strings were detected, may be used to obfuscate strings (option --decode to see all)

Intelligence

File Origin
# of uploads :
2
# of downloads :
3'645
Origin country :
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
0001.xls
Verdict:
No threats detected
Analysis date:
2024-10-29 15:32:36 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/bb1c8289-fe9e-4899-b365-3a00f046835c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Malicious
File type:
application/vnd.ms-excel
Has a screenshot:
False
Contains macros:
True
Detection(s):
TwinWave.EvilDoc.93TilInfinity.20240412.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6720ff07a75e41aa6722c17d
Tags:
Powershell Exploit Trojan W97m
Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Using the Windows Management Instrumentation requests
DNS request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
macros
Link:
https://www.filescan.io/uploads/6720ff033a8e01910c8cb59c/reports/a3df7093-cb39-4deb-9246-bc085c386208/overview
Verdict:
Malicious
Labled as:
CVE-2017-0199
Link:
https://www.hybrid-analysis.com/sample/8f4cb3b0aaf0bdbbcc6d080385fab14ae0cf71d8e46770902ade7f5e4099b5da
Label:
Benign
Suspicious Score:
2.1/10
Score Malicious:
21%
Score Benign:
79%
Link:
https://www.malware.ai/gui/files/?id=e97bb705-b9c7-42fb-a440-2f3326fc17f2
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
rans.phis.troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1544692
Signature
Bypasses PowerShell execution policy
C2 URLs / IPs found in malware configuration
Contains functionality to bypass UAC (CMSTPLUA)
Contains functionality to inject code into remote processes
Contains functionality to register a low level keyboard hook
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Contains functionalty to change the wallpaper
Delayed program exit found
Detected Remcos RAT
Document exploit detected (process start blacklist hit)
Excel sheet contains many unusual embedded objects
Found malware configuration
Injects a PE file into a foreign processes
Installs a global keyboard hook
Installs new ROOT certificates
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Microsoft Office drops suspicious files
Multi AV Scanner detection for submitted file
Obfuscated command line found
PowerShell case anomaly found
Searches for Windows Mail specific files
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: Dot net compiler compiles file from suspicious location
Sigma detected: File With Uncommon Extension Created By An Office Application
Sigma detected: Potential PowerShell Command Line Obfuscation
Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands
Sigma detected: Potentially Suspicious PowerShell Child Processes
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: PowerShell Base64 Encoded Invoke Keyword
Sigma detected: Remcos
Sigma detected: Suspicious Microsoft Office Child Process
Sigma detected: Suspicious MSHTA Child Process
Sigma detected: Suspicious PowerShell Parameter Substring
Sigma detected: WScript or CScript Dropper
Suricata IDS alerts for network traffic
Suspicious execution chain found
Suspicious powershell command line found
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file / registry access)
Tries to steal Mail credentials (via file registry)
Uses dynamic DNS services
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Yara detected Powershell download and execute
Yara detected Remcos RAT
Yara detected UAC Bypass using CMSTP
Yara detected WebBrowserPassView password recovery tool
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1544692 Sample: 0001.xls Startdate: 29/10/2024 Architecture: WINDOWS Score: 100 100 Suricata IDS alerts for network traffic 2->100 102 Found malware configuration 2->102 104 Malicious sample detected (through community Yara rule) 2->104 106 23 other signatures 2->106 12 EXCEL.EXE 57 41 2->12         started        process3 dnsIp4 96 192.3.101.21, 49164, 49166, 49167 AS-COLOCROSSINGUS United States 12->96 98 acesso.run 172.67.162.95, 443, 49163, 49168 CLOUDFLARENETUS United States 12->98 76 C:\Users\user\Desktop\0001.xls (copy), Composite 12->76 dropped 78 seemybestthingwhic...inesswogiven[1].hta, HTML 12->78 dropped 142 Microsoft Office drops suspicious files 12->142 17 mshta.exe 10 12->17         started        21 mshta.exe 10 12->21         started        23 AcroRd32.exe 21 12->23         started        file5 signatures6 process7 dnsIp8 80 acesso.run 17->80 108 Suspicious powershell command line found 17->108 110 PowerShell case anomaly found 17->110 25 powershell.exe 17->25         started        82 104.21.74.191, 443, 49165, 49170 CLOUDFLARENETUS United States 21->82 84 acesso.run 21->84 28 powershell.exe 22 21->28         started        signatures9 process10 file11 72 seethebestthingsgi...tirelifeforgeth.VBs, Unicode 25->72 dropped 31 wscript.exe 25->31         started        34 csc.exe 25->34         started        37 powershell.exe 25->37         started        74 C:\Users\user\AppData\...\htcuymda.cmdline, Unicode 28->74 dropped 138 Suspicious powershell command line found 28->138 140 Obfuscated command line found 28->140 39 powershell.exe 4 28->39         started        41 csc.exe 2 28->41         started        signatures12 process13 file14 144 Suspicious powershell command line found 31->144 146 Wscript starts Powershell (via cmd or directly) 31->146 148 Bypasses PowerShell execution policy 31->148 152 2 other signatures 31->152 43 powershell.exe 31->43         started        66 C:\Users\user\AppData\Local\...\1vm3e1kt.dll, PE32 34->66 dropped 46 cvtres.exe 34->46         started        150 Installs new ROOT certificates 39->150 68 C:\Users\user\AppData\Local\...\htcuymda.dll, PE32 41->68 dropped 48 cvtres.exe 41->48         started        signatures15 process16 signatures17 126 Suspicious powershell command line found 43->126 128 Obfuscated command line found 43->128 50 powershell.exe 43->50         started        process18 dnsIp19 86 drive.google.com 142.250.184.206, 443, 49173 GOOGLEUS United States 50->86 88 drive.usercontent.google.com 172.217.16.193, 443, 49174 GOOGLEUS United States 50->88 112 Writes to foreign memory regions 50->112 114 Injects a PE file into a foreign processes 50->114 54 CasPol.exe 50->54         started        signatures20 process21 dnsIp22 90 cokka.duckdns.org 54->90 92 cokka.duckdns.org 192.3.101.193, 49176, 49177, 9674 AS-COLOCROSSINGUS United States 54->92 94 geoplugin.net 178.237.33.50, 49178, 80 ATOM86-ASATOM86NL Netherlands 54->94 70 C:\ProgramData\remcos\logs.dat, data 54->70 dropped 116 Contains functionality to bypass UAC (CMSTPLUA) 54->116 118 Detected Remcos RAT 54->118 120 Tries to steal Mail credentials (via file registry) 54->120 124 8 other signatures 54->124 59 CasPol.exe 54->59         started        62 CasPol.exe 54->62         started        64 CasPol.exe 54->64         started        file23 122 Uses dynamic DNS services 90->122 signatures24 process25 signatures26 130 Tries to steal Instant Messenger accounts or passwords 59->130 132 Tries to steal Mail credentials (via file / registry access) 59->132 134 Searches for Windows Mail specific files 59->134 136 Tries to harvest and steal browser information (history, passwords, etc) 62->136
Score:
100%
Verdict:
Malware
File Type:
OFFICE
Link:
https://malprob.io/report/8f4cb3b0aaf0bdbbcc6d080385fab14ae0cf71d8e46770902ade7f5e4099b5da
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8f4cb3b0aaf0bdbbcc6d080385fab14ae0cf71d8e46770902ade7f5e4099b5da/
Threat name:
Document-Excel.Exploit.CVE-2017-0199
Create hunting rule
Status:
Malicious
First seen:
2024-10-29 12:52:26 UTC
File Type:
Document
Extracted files:
271
AV detection:
12 of 24 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=r5glhmfk6c63xtdnbabyl6vrjlqm64oy4rtxbebk3z7v4qezwxna._file
Result
Malware family:
n/a
Score:
  10/10
Tags:
defense_evasion discovery execution
Link:
https://tria.ge/reports/241029-swa3tawfkh/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies Internet Explorer settings
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Uses Volume Shadow Copy WMI provider
Uses Volume Shadow Copy service COM API
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Drops file in System32 directory
Legitimate hosting services abused for malware hosting/C2
Blocklisted process makes network request
Command and Scripting Interpreter: PowerShell
Evasion via Device Credential Deployment
Process spawned unexpected child process
Malware Config
Dropper Extraction:
https://drive.google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur
Malware Family:
n/a
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/747683a1-46ab-4c01-ad6b-d2dc7e7ca666
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8f4cb3b0aaf0bdbbcc6d080385fab14ae0cf71d8e46770902ade7f5e4099b5da

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:informational_win_ole_protected
Create hunting rule
Author:Jeff White (karttoon@gmail.com) @noottrak
Description:Identify OLE Project protection within documents.
Rule name:XLS_STRINGS
Create hunting rule
Author:somedieyoungZZ
Description:Detect Strings targeting Bangladesh

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

Excel file xls 8f4cb3b0aaf0bdbbcc6d080385fab14ae0cf71d8e46770902ade7f5e4099b5da

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments