MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9447ec740c00035c0b0e6c32ea86cc4e7585477e5c97f353b42aeee9dafd9cab. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9447ec740c00035c0b0e6c32ea86cc4e7585477e5c97f353b42aeee9dafd9cab
SHA3-384 hash: bad7113b450ad6f35dd51b8a2e3787be4795518a44e9badb3273e346d67a79a028e0681ac1bf128acc8c9c0b51b5589b
SHA1 hash: 9d6aefae4df99363e9d909dc2cd33811e4accad0
MD5 hash: 348af9d5fd2181579c460eebb73ef3ca
humanhash: blue-quebec-ohio-michigan
File name:attack.ps1
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:5'010 bytes
First seen:2022-05-09 17:21:14 UTC
Last seen:2022-05-09 17:27:20 UTC
File type:PowerShell (PS) ps1
MIME type:text/plain
ssdeep 48:CBn6zALDCn/r4vGXKQuT4vGX1ebB7xxg8PzUPeSy3n5ZWibrE7xxpsGyN5nVJA7J:CB6zVnUujruYlxbnExLAexr1nPnx
Threatray 1'198 similar samples on MalwareBazaar
TLSH T134A112BAF684C5B0C61FE6398248BC1C0520BAC3C2D02DC467BC6C2A9C95FCF6D656C0
Reporter pr0xylife
Tags:ps1 RemcosRAT

Intelligence

File Origin
# of uploads :
2
# of downloads :
322
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.DownLoader44.58146.28458.5013.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
powershell powershell
Link:
https://www.filescan.io/uploads/62794dd0bd5c76586e25b416/reports/b396a597-4b28-4c4a-8fd0-d8ac1e9afe2f/overview
Result
Verdict:
UNKNOWN
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/990395
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
System process connects to network (likely due to code injection or exploit)
Writes to foreign memory regions
Yara detected Costura Assembly Loader
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Download SVG
Detection:
remcos
Create hunting rule
Link:
https://mwdb.cert.pl/sample/9447ec740c00035c0b0e6c32ea86cc4e7585477e5c97f353b42aeee9dafd9cab/
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
576183a33f5247a852bc65a4dc4cbca5762bfbad1291a82572681f7075dc6123
RemcosRAT
5974a6fcf0503f34709dbcc572d30d76ab64f655444ae83f088ec975ab26cb7d
RemcosRAT
6ea504859dafb477ac16b815e303fc121472298e1cbde707bf292b3432ec20e1
RemcosRAT
81b648fca4135b631044dd68aee71ee704dcc930ae635658b9438585c5dc6b90
RemcosRAT
ba8d32d0c7844fdd2e5c4311fc6dc7a400d7c1ff97bebd9760d62308c669fb8f
RemcosRAT
c52d747cc20d321a0185798c328468b564f9c5a213270ad07861fa7cc147fdda
RemcosRAT
fafd7463254353a7e4ea4900b93f412fb84bbbddae730fc145c54331eb2533f8
RemcosRAT
+ 1'188 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:remotehost rat
Link:
https://tria.ge/reports/220509-vxjsfsgfem/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Blocklisted process makes network request
Remcos
Malware Config
C2 Extraction:
freshdirect.dvrlists.com:119
Malware family:
Remcos
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/9447ec740c00/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9447ec740c00035c0b0e6c32ea86cc4e7585477e5c97f353b42aeee9dafd9cab

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments