MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8f8ceb98b60d548d502c480c051d1aeb2b6b77f0ba90452e8e8f25d4c3d7c95c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	8f8ceb98b60d548d502c480c051d1aeb2b6b77f0ba90452e8e8f25d4c3d7c95c
SHA3-384 hash:	4740fc3a61cbe536bb3bb4728fa9a9e8aba410f64f439f5d1c5a82c6de809399ef480fc8ceedcc38c0e017fb4790b05e
SHA1 hash:	fea1488f2b62d50deeb8987f7b2831bb72457e11
MD5 hash:	10ea775bdb4bf882559e3787cc4c9a49
humanhash:	batman-speaker-massachusetts-kilo
File name:	SOA_P990T341_JAN_2024.Tar
Download:	download sample
Signature	RemcosRAT Alert Create hunting rule
File size:	1'356'228 bytes
First seen:	2024-02-08 06:55:14 UTC
Last seen:	2024-02-08 07:31:59 UTC
File type:	rar
MIME type:	application/x-rar
ssdeep	24576:rpT07TwI4u6X/+lXthOcAyxTAGoHTOR04M4g0zW9vwtfaVJBH64oPny2:rG3P1dthOhyTKTO24MjwWpwdaVJBH/eF
TLSH	T1055533CD18D7B9C5C189BFAF03E40B4106A5EFBD0E3A47168B845DE69658A63D07F283
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter	cocaman
Tags:	rar RemcosRAT tar

cocaman

Malicious email (T1566.001)
From: "Account Payables<tada@dibec.co.jp>" (likely spoofed)
Received: "from dibec.co.jp (unknown [45.9.168.92]) "
Date: "7 Feb 2024 23:30:58 -0800"
Subject: "Re: SOA-P990T341/JAN/2024"
Attachment: "SOA_P990T341_JAN_2024.Tar"

Intelligence

---

File Origin

# of uploads :

4

# of downloads :

93

Origin country :

CH

Vendor Threat Intelligence

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

certutil lolbin obfuscated ping

Link:

https://www.filescan.io/uploads/65c47b0604c91578faaff855/reports/58907229-48cb-4619-aa44-2d628ccc9d2d/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/8f8ceb98b60d548d502c480c051d1aeb2b6b77f0ba90452e8e8f25d4c3d7c95c

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/8f8ceb98b60d548d502c480c051d1aeb2b6b77f0ba90452e8e8f25d4c3d7c95c/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=r6goxgfwbvki2ubmjagakhi25mvww57qxkiekluor4s5jq6xzfoa._file

Hatching Triage remcos

Result

Malware family:

remcos

Alert

Create hunting rule

Score:

  10/10

Tags:

family:modiloader family:remcos botnet:remotehost persistence rat trojan

Link:

https://tria.ge/reports/240208-hw4d9aeehk/

Behaviour

Enumerates system info in registry

Runs ping.exe

Script User-Agent

Suspicious behavior: CmdExeWriteProcessMemorySpam

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: LoadsDriver

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Program crash

Launches sc.exe

Adds Run key to start application

Executes dropped EXE

Loads dropped DLL

Creates new service(s)

ModiLoader Second Stage

ModiLoader, DBatLoader

Remcos

Malware Config

C2 Extraction:

127.0.0.1:45671
127.0.0.1:55677
192.3.101.8:55677
192.3.101.8:45671

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/8f8ceb98b60d548d502c480c051d1aeb2b6b77f0ba90452e8e8f25d4c3d7c95c