MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 93bed72b3d4ffe89ccdb40312a58874597dbab3a5e0e65966f9d56c618845df1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemcosRAT

Vendor detections: 17

Intelligence 17 IOCs YARA 6 File information Comments 1

SHA256 hash:	93bed72b3d4ffe89ccdb40312a58874597dbab3a5e0e65966f9d56c618845df1
SHA3-384 hash:	12118fd5ff7df7f64075b42fb5480400642f18530903decb982a3c8eabe0724d32d761a6c6d3ce8d497806f6eccc7d5a
SHA1 hash:	009f307cc38178f3d227d7b75c20e9928a37f737
MD5 hash:	5f90f8a45a88be83a6dbe5eac34f6c9d
humanhash:	steak-summer-low-gee
File name:	5f90f8a45a88be83a6dbe5eac34f6c9d
Download:	download sample
Signature	RemcosRAT Create hunting rule
File size:	86'016 bytes
First seen:	2022-08-23 12:14:39 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f79bdf7005a27b505da0a17f8329bd86 (10 x RemcosRAT)
ssdeep	1536:6pNEsaeiQl8TIqytzRJl+uiNuI7FFCPBsZcOzq1T35T/4LeILtVo8V:6pNEaiQl2qouiNdFFCiZcOz+TJ/ueAt
TLSH	T1C483F707FE07C1F3E81102B21B553762AFBDEC231619A927C745C581EEB8C4AE4B567A
TrID	38.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 20.5% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 13.0% (.EXE) Win64 Executable (generic) (10523/12/4) 8.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 6.2% (.EXE) Win16 NE executable (generic) (5038/12/1)
File icon (PE):
dhash icon	d4a22b2e0792f0f0 (16 x RemcosRAT, 1 x NetWire)
Reporter	zbetcheckin
Tags:	32 exe RemcosRAT

Intelligence

File Origin

# of uploads :

# of downloads :

279

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

remcos

ID:

File name:

5f90f8a45a88be83a6dbe5eac34f6c9d

Verdict:

Malicious activity

Analysis date:

2022-08-23 12:19:19 UTC

Tags:

rat remcos

Link:

https://app.any.run/tasks/35b94003-1e85-4ce7-ac87-b45883453078

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Remcos

Link:

https://www.capesandbox.com/analysis/300546/

Detection(s):

Win.Trojan.Remcos-9763891-0

Win.Malware.Mikey-6843399-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Creating a file

Creating a window

Result

Malware family:

n/a

Score:

5/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/29789/overview

Behaviour

MalwareBazaar

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

REMCOS

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/aaa63772-1063-4525-99cb-94186270b7c0

Result

Threat name:

Remcos

Detection:

malicious

Classification:

troj

Score:

80 / 100

Link:

https://www.joesandbox.com/analysis/1056219

Signature

Antivirus / Scanner detection for submitted sample

C2 URLs / IPs found in malware configuration

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Remcos RAT

Behaviour

Behavior Graph:

Download SVG

Detection:

remcos

Link:

https://mwdb.cert.pl/sample/93bed72b3d4ffe89ccdb40312a58874597dbab3a5e0e65966f9d56c618845df1/

Threat name:

Win32.Backdoor.Remcos

Status:

Malicious

First seen:

2022-08-23 11:53:18 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

23 of 26 (88.46%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=so7nokz5j77ittg3iaysuwehiwl5xkz2lyhglftptvlmmgeelxyq._file

Verdict:

malicious

Label(s):

remcos

Result

Malware family:

remcos

Score:

10/10

Tags:

family:remcos botnet:remotehost

Link:

https://tria.ge/reports/220823-pewreaeeam/

Behaviour

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Malware Config

C2 Extraction:

192.168.1.4:2404

Unpacked files

SH256 hash:

93bed72b3d4ffe89ccdb40312a58874597dbab3a5e0e65966f9d56c618845df1

MD5 hash:

5f90f8a45a88be83a6dbe5eac34f6c9d

SHA1 hash:

009f307cc38178f3d227d7b75c20e9928a37f737

Detections:

win_remcos_auto

Link:

https://www.unpac.me/results/02d2b64e-2e94-447c-acb2-97a4083d401f/

Malware family:

Remcos

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/93bed72b3d4f/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.95

Link:

https://yomi.yoroi.company/submissions/93bed72b3d4ffe89ccdb40312a58874597dbab3a5e0e65966f9d56c618845df1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	malware_Remcos_strings Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Remcos in memory

Rule name:	Remcos Create hunting rule
Author:	kevoreilly
Description:	Remcos Payload

Rule name:	remcos_rat Create hunting rule
Author:	jeFF0Falltrades

Rule name:	REMCOS_RAT_variants Create hunting rule

Rule name:	SUSP_VBS_Wscript_Shell Create hunting rule
Author:	SECUINFRA Falcon Team
Description:	Detects the definition of 'Wscript.Shell' which is often used by Malware, FPs are possible and commmon