MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 92aaa412fd4384f56646d3b70ae7e8f4e26e436501ac61b9dd29652162a2997c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 11


Intelligence 11 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 92aaa412fd4384f56646d3b70ae7e8f4e26e436501ac61b9dd29652162a2997c
SHA3-384 hash: d31da3f5b73c04c16515f048eaf9664ebc3235d4b8620949dfce7cef3b43b086039b9517a67c2b27e2579ee8516a8149
SHA1 hash: 0e1bdb2215010ecd58fb847a06c780e1b67f3cf6
MD5 hash: 1984154af6e8dc43909b7a3880212d6c
humanhash: failed-quebec-three-muppet
File name:EXTRACTO_SERFINANZA_763491694580295682345_2506299590056647_254934221025470843464344641438_1557713157182575338992538102_p
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:176'640 bytes
First seen:2021-04-26 06:17:14 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'659 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 3072:gLWBIhD5D819xtuAM+M9cacQ4ytis/HVbmxxxxxxxxxxxxxxxxxxxxxxxxxxxxx0:gLl781Mv+gOqMs/XLKmV
Threatray 1'915 similar samples on MalwareBazaar
TLSH 8704C8E1E280B2D1E66A4471A437CC701643BA3ECC94495D319D327EEF7225668BECDB
Reporter abuse_ch
Tags:RemcosRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
148
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
EXTRACTO_SERFINANZA_763491694580295682345_2506299590056647_254934221025470843464344641438_1557713157182575338992538102_p
Verdict:
Malicious activity
Analysis date:
2021-04-26 06:22:19 UTC
Tags:
trojan dtloader loader rat remcos keylogger
Link:
https://app.any.run/tasks/7f212810-234b-4c07-b926-52c2f88740e1

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/144211/
Detection(s):
SecuriteInfo.com.Variant.Barys.875.17885.19180.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Running batch commands
DNS request
Sending an HTTP GET request
Creating a file
Creating a file in the %temp% subdirectories
Creating a process from a recently created file
Creating a process with a hidden window
Launching a service
Sending a UDP request
Deleting a recently created file
Launching a process
Creating a file in the %AppData% subdirectories
Enabling the 'hidden' option for recently created files
Unauthorized injection to a recently created process
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a recently created process by context flags manipulation
Setting a global event handler for the keyboard
Connection attempt to an infection source
Adding exclusions to Windows Defender
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
REMCOS
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/80e92643-b7c4-49a2-9bb9-13819e368963
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
rans.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/697458
Signature
Adds a directory exclusion to Windows Defender
C2 URLs / IPs found in malware configuration
Contains functionality to capture and log keystrokes
Contains functionality to inject code into remote processes
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Contains functionalty to change the wallpaper
Detected Remcos RAT
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Remcos
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 397651 Sample: 8992538102_p Startdate: 26/04/2021 Architecture: WINDOWS Score: 100 82 databasepropersonombrecomercialideasearchwords.services 2->82 90 Multi AV Scanner detection for domain / URL 2->90 92 Found malware configuration 2->92 94 Malicious sample detected (through community Yara rule) 2->94 96 7 other signatures 2->96 12 8992538102_p.exe 21 8 2->12         started        17 PxxoServicesTrialNet1.exe 2->17         started        19 PxxoServicesTrialNet1.exe 2->19         started        signatures3 process4 dnsIp5 86 xwjhdjylqeypyltby.ml 104.21.88.107, 49701, 80 CLOUDFLARENETUS United States 12->86 74 C:\Users\user\...\8992538102_p.exe.log, ASCII 12->74 dropped 76 C:\Users\user\AppData\...\AdvancedRun.exe, PE32 12->76 dropped 106 Contains functionalty to change the wallpaper 12->106 108 Contains functionality to steal Chrome passwords or cookies 12->108 110 Contains functionality to capture and log keystrokes 12->110 116 2 other signatures 12->116 21 8992538102_p.exe 4 5 12->21         started        24 powershell.exe 24 12->24         started        26 AdvancedRun.exe 1 12->26         started        78 C:\Users\user\AppData\...\AdvancedRun.exe, PE32 17->78 dropped 112 Adds a directory exclusion to Windows Defender 17->112 114 Injects a PE file into a foreign processes 17->114 28 PxxoServicesTrialNet1.exe 17->28         started        31 AdvancedRun.exe 17->31         started        33 powershell.exe 17->33         started        37 2 other processes 17->37 80 C:\Users\user\AppData\...\AdvancedRun.exe, PE32 19->80 dropped 35 AdvancedRun.exe 19->35         started        file6 signatures7 process8 dnsIp9 68 C:\Users\user\...\PxxoServicesTrialNet1.exe, PE32 21->68 dropped 70 PxxoServicesTrialN...exe:Zone.Identifier, ASCII 21->70 dropped 39 wscript.exe 1 21->39         started        42 conhost.exe 24->42         started        44 AdvancedRun.exe 26->44         started        88 databasepropersonombrecomercialideasearchwords.services 186.169.38.241, 3521 COLOMBIATELECOMUNICACIONESSAESPCO Colombia 28->88 46 AdvancedRun.exe 31->46         started        48 conhost.exe 33->48         started        50 AdvancedRun.exe 35->50         started        file10 process11 dnsIp12 84 192.168.2.1 unknown unknown 39->84 52 cmd.exe 39->52         started        process13 process14 54 PxxoServicesTrialNet1.exe 52->54         started        58 conhost.exe 52->58         started        file15 72 C:\Users\user\AppData\...\AdvancedRun.exe, PE32 54->72 dropped 98 Multi AV Scanner detection for dropped file 54->98 100 Machine Learning detection for dropped file 54->100 102 Adds a directory exclusion to Windows Defender 54->102 104 Injects a PE file into a foreign processes 54->104 60 AdvancedRun.exe 54->60         started        62 powershell.exe 54->62         started        signatures16 process17 process18 64 AdvancedRun.exe 60->64         started        66 conhost.exe 62->66         started       
Detection:
remcos
Create hunting rule
Link:
https://mwdb.cert.pl/sample/92aaa412fd4384f56646d3b70ae7e8f4e26e436501ac61b9dd29652162a2997c/
Threat name:
Win32.Trojan.Woreflint
Create hunting rule
Status:
Malicious
First seen:
2021-04-26 06:18:12 UTC
AV detection:
7 of 47 (14.89%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=skvkiex5iocpkzsg2o3qvz7i6trg4q3fagwgdoo5ffsscyvctf6a._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
0769c1487705fd65aeacdd813882e532d3bbd4ffa7106a2015bac448d8091bbb
RemcosRAT
4579780c18fb273fd0884237c7a4021dbbb38494194d8c1840449e8a62d29251
RemcosRAT
4fe8c8398a6cf30cfd7cbed590de821abdb40aa177781c43c19bdfec75308355
RemcosRAT
522a495b289cf22898f762f18571b8839194e6232cb80fbb28dc426cbeeee323
RemcosRAT
622a12c9935eb8f0cfa499bb445642a837fa150a161e5393f7a1d759e6f94f02
RemcosRAT
833b575dac3a049ede0d27e2ff801d2e8d647cf04006f0037e1a9c71d7c8ace4
RemcosRAT
ab9041fe7e0a4a439521d6eb01cc16d74c00a0427c86b067120ac453ba7329d9
RemcosRAT
c39bdd8f7c69c3140ef920e2b1d5965310058c5fa425b871f4d7751d8291d55e
RemcosRAT
cee5cdde8972799268ab97a77880793470dfc0d93c5e697bb66f83b6675f51ba
RemcosRAT
e0d4ce0316734fce0ea0d950f0ff1b4182f1364d581c549a199ac041cfe68ebb
RemcosRAT
+ 1'905 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos evasion persistence rat trojan
Link:
https://tria.ge/reports/210426-fajmn3fq96/
Behaviour
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Loads dropped DLL
Windows security modification
Executes dropped EXE
Nirsoft
Modifies Windows Defender Real-time Protection settings
Remcos
Turns off Windows Defender SpyNet reporting
Windows security bypass
Malware Config
C2 Extraction:
databasepropersonombrecomercialideasearchwords.services:3521
Unpacked files
SH256 hash:
92aaa412fd4384f56646d3b70ae7e8f4e26e436501ac61b9dd29652162a2997c
MD5 hash:
1984154af6e8dc43909b7a3880212d6c
SHA1 hash:
0e1bdb2215010ecd58fb847a06c780e1b67f3cf6
Link:
https://www.unpac.me/results/8c27a6f3-bbf9-4d1a-977e-b275218d064e/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/92aaa412fd4384f56646d3b70ae7e8f4e26e436501ac61b9dd29652162a2997c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/144211/

Comments