MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 932382f377c00f267e7f102d6fb94aa69d6052302106d3578511e8c70e82bb70. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 15


Intelligence 15 IOCs YARA 2 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 932382f377c00f267e7f102d6fb94aa69d6052302106d3578511e8c70e82bb70
SHA3-384 hash: 8df3c6259813467010c5b25790fc600a06b570c423a440e37f5cdf91b226b0b31396b1f5dd77646119b40b072ad04aa1
SHA1 hash: dec6df7d20dec256a0a5547fb9e4f297b1dd96f7
MD5 hash: a5dcc0d9f44de85e8895ebb37aab0639
humanhash: hotel-apart-eighteen-yankee
File name:a5dcc0d9f44de85e8895ebb37aab0639
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:224'768 bytes
First seen:2022-01-25 13:02:56 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 6144:rndLsSY6Fd/ysPqEyqfmn73uCkcWxmvETy+9Ja:rpsSYdEyqfmnSKUmvETy+
Threatray 2'545 similar samples on MalwareBazaar
TLSH T15C24022582ED5727D9FE1ABC95E2130103F13488A2B2FB9A6ECDA19B1D737401520F5F
Reporter zbetcheckin
Tags:32 exe RemcosRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
169
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
a5dcc0d9f44de85e8895ebb37aab0639
Verdict:
Malicious activity
Analysis date:
2022-01-25 13:13:35 UTC
Tags:
rat remcos
Link:
https://app.any.run/tasks/707d04b3-9d6f-4c28-8df6-c95a9b82642a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Remcos
Create hunting rule
Link:
https://www.capesandbox.com/analysis/222458/
Detection(s):
Win.Packed.Nanocore-9937493-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
DNS request
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Сreating synchronization primitives
Creating a process from a recently created file
Creating a process with a hidden window
Creating a file in the %temp% directory
Launching a process
Creating a file
Creating a file in the %AppData% subdirectories
Running batch commands
Sending an HTTP GET request
Unauthorized injection to a recently created process
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Enabling autorun by creating a file
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware keylogger nanocore obfuscated packed
Link:
https://www.filescan.io/uploads/61eff50b0f8c757253e74ee7/reports/82c7c340-4bf5-4088-9429-281a12f245b1/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
REMCOS
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/202729d4-3658-418f-a4ee-a0c74496c724
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/927103
Signature
Adds a directory exclusion to Windows Defender
Allocates memory in foreign processes
Contains functionality to capture and log keystrokes
Contains functionality to detect virtual machines (IN, VMware)
Contains functionality to inject code into remote processes
Contains functionality to log keystrokes (.Net Source)
Contains functionality to register a low level keyboard hook
Contains functionality to steal Chrome passwords or cookies
Detected Remcos RAT
Drops PE files with benign system names
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: File Created with System Process Name
Sigma detected: Powershell Defender Exclusion
Sigma detected: Suspcious CLR Logs Creation
Sigma detected: Suspect Svchost Activity
Sigma detected: Suspicious Svchost Process
Sigma detected: Suspicius Add Task From User AppData Temp
Sigma detected: System File Execution Location Anomaly
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 559584 Sample: 13j9kRyDgJ Startdate: 25/01/2022 Architecture: WINDOWS Score: 100 85 pvtrans.ydns.eu 2->85 95 Malicious sample detected (through community Yara rule) 2->95 97 System process connects to network (likely due to code injection or exploit) 2->97 99 Multi AV Scanner detection for dropped file 2->99 101 16 other signatures 2->101 11 13j9kRyDgJ.exe 7 2->11         started        15 svchost.exe 2->15         started        17 svchost.exe 2->17         started        19 svchost.exe 1 2->19         started        signatures3 process4 file5 75 C:\Users\user\AppData\...\HuzKkvOaVDHCNb.exe, PE32 11->75 dropped 77 C:\...\HuzKkvOaVDHCNb.exe:Zone.Identifier, ASCII 11->77 dropped 79 C:\Users\user\AppData\Local\...\tmp4153.tmp, XML 11->79 dropped 81 C:\Users\user\AppData\...\13j9kRyDgJ.exe.log, ASCII 11->81 dropped 115 Contains functionality to detect virtual machines (IN, VMware) 11->115 117 Contains functionality to steal Chrome passwords or cookies 11->117 119 Contains functionality to capture and log keystrokes 11->119 125 4 other signatures 11->125 21 13j9kRyDgJ.exe 1 5 11->21         started        24 powershell.exe 25 11->24         started        26 schtasks.exe 1 11->26         started        121 Adds a directory exclusion to Windows Defender 15->121 123 Injects a PE file into a foreign processes 15->123 28 svchost.exe 15->28         started        32 powershell.exe 15->32         started        34 schtasks.exe 15->34         started        signatures6 process7 dnsIp8 69 C:\Users\user\AppData\Roaming\...\svchost.exe, PE32 21->69 dropped 71 C:\Users\user\...\svchost.exe:Zone.Identifier, ASCII 21->71 dropped 73 C:\Users\user\AppData\Local\...\install.bat, ASCII 21->73 dropped 36 cmd.exe 1 21->36         started        39 conhost.exe 24->39         started        41 conhost.exe 26->41         started        89 pvtrans.ydns.eu 185.140.53.10, 3030, 49754, 49757 DAVID_CRAIGGG Sweden 28->89 127 System process connects to network (likely due to code injection or exploit) 28->127 129 Installs a global keyboard hook 28->129 43 conhost.exe 32->43         started        45 conhost.exe 34->45         started        file9 signatures10 process11 signatures12 103 Uses ping.exe to sleep 36->103 105 Uses ping.exe to check the status of other devices and networks 36->105 47 svchost.exe 5 36->47         started        51 PING.EXE 1 36->51         started        54 conhost.exe 36->54         started        process13 dnsIp14 83 C:\Users\user\AppData\...\svchost.exe.log, ASCII 47->83 dropped 91 Adds a directory exclusion to Windows Defender 47->91 93 Injects a PE file into a foreign processes 47->93 56 svchost.exe 47->56         started        59 powershell.exe 47->59         started        61 schtasks.exe 47->61         started        87 127.0.0.1 unknown unknown 51->87 file15 signatures16 process17 signatures18 107 Detected Remcos RAT 56->107 109 Writes to foreign memory regions 56->109 111 Allocates memory in foreign processes 56->111 113 Injects a PE file into a foreign processes 56->113 63 iexplore.exe 56->63         started        65 conhost.exe 59->65         started        67 conhost.exe 61->67         started        process19
Detection:
remcos
Create hunting rule
Link:
https://mwdb.cert.pl/sample/932382f377c00f267e7f102d6fb94aa69d6052302106d3578511e8c70e82bb70/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-01-25 11:37:26 UTC
File Type:
PE (.Net Exe)
Extracted files:
5
AV detection:
25 of 28 (89.29%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=smryf43xyahsm7t7caww7okku2owaurqeedngv4fchumoducxnya._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
838646bc9841804d7671fb25b3fd5d3e67e91c1d341c7125ce63ad436ada5f26
RemcosRAT
97633db1552b4791c99177e854d262a0d1021d44ee8717dc13bac90d6f55ae01
RemcosRAT
a8db04465f62d993cc1e2413fd0710700ab10335729c3aaa0b663f98c3420a1a
RemcosRAT
b16702237b0fa9a919093458ca1711fe959e8ba2b7b885021237cf5b83d84e5b
RemcosRAT
d233487e4f8fc63bb27cbf4344429740300d34049aa4e81afd133799bc0d3777
RemcosRAT
dab7ab7eb49e234ff176d99f19706984aeabab597c2315e72d03b4c2289fbb95
RemcosRAT
+ 2'535 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:host brand:microsoft persistence phishing rat upx
Link:
https://tria.ge/reports/220125-qacy6sgdf6/
Behaviour
Creates scheduled task(s)
Modifies Internet Explorer settings
Modifies registry class
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Windows directory
Detected potential entity reuse from brand microsoft.
Suspicious use of SetThreadContext
Adds Run key to start application
Deletes itself
Loads dropped DLL
Executes dropped EXE
UPX packed file
Remcos
Malware Config
C2 Extraction:
pvtrans.ydns.eu:3030
Unpacked files
SH256 hash:
71f0122578e1a96b5b283a53edc939d7b435dc11fdba9fc997fa2a0689d847a5
MD5 hash:
b1cf369b942684b554757dba242657a0
SHA1 hash:
a04971b3875595d57088a3578a677608506a446c
Detections:
win_remcos_g0
Create hunting rule
win_remcos_auto
Create hunting rule
Link:
https://www.unpac.me/results/14f38ff6-45b9-4e72-a90e-bd6370bf5d60/
SH256 hash:
bb4579a765aa3376c6e71b7446fc5a98f443e39ce01f373f84d8234b0c09e937
MD5 hash:
5089bc98a04eae122927852b34a8dddc
SHA1 hash:
fefa69cee97f3d75faec208edfc210ed56e906a2
Link:
https://www.unpac.me/results/14f38ff6-45b9-4e72-a90e-bd6370bf5d60/
SH256 hash:
d1e78aec7992e715e78437f09a3499c2d393a21ba7bcedf35d5803ce14208f60
MD5 hash:
37d9802511fa5925fd1956af261b6c8f
SHA1 hash:
dedba674b054f7f3237d462681212e07b8eb025b
Link:
https://www.unpac.me/results/14f38ff6-45b9-4e72-a90e-bd6370bf5d60/
SH256 hash:
932382f377c00f267e7f102d6fb94aa69d6052302106d3578511e8c70e82bb70
MD5 hash:
a5dcc0d9f44de85e8895ebb37aab0639
SHA1 hash:
dec6df7d20dec256a0a5547fb9e4f297b1dd96f7
Link:
https://www.unpac.me/results/14f38ff6-45b9-4e72-a90e-bd6370bf5d60/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/932382f377c00f267e7f102d6fb94aa69d6052302106d3578511e8c70e82bb70

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RemcosRAT

Executable exe 932382f377c00f267e7f102d6fb94aa69d6052302106d3578511e8c70e82bb70

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2005138/
Cape
Cape
https://www.capesandbox.com/analysis/222458/

Comments


Avatar
zbet commented on 2022-01-25 13:02:57 UTC

url : hxxp://vacandgold.com/amu.exe