MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 95311fc0f7c080fc57155842d9f00c404813f27744c9142dfb785d0bcd410190. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemcosRAT

Vendor detections: 12

Intelligence 12 IOCs YARA 10 File information Comments

SHA256 hash:	95311fc0f7c080fc57155842d9f00c404813f27744c9142dfb785d0bcd410190
SHA3-384 hash:	b0b2c0b58a82df1686a1bdbe6019da05c33fee45c07260b634cc39630c58ac8289aed073f90a4139d45c40f363294906
SHA1 hash:	b8ee90718310eeab41306d79df5f1cc8b02f7f5b
MD5 hash:	4ef725e78d41b96d40ad546b5d92efe9
humanhash:	december-eleven-jig-six
File name:	Enquiry 220062.exe
Download:	download sample
Signature	RemcosRAT Create hunting rule
File size:	1'129'984 bytes
First seen:	2024-05-17 14:41:30 UTC
Last seen:	2024-05-17 15:21:47 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	79ff6e57ca539a4918908918009e3825 (5 x RemcosRAT, 1 x Formbook, 1 x DBatLoader)
ssdeep	24576:b6G5oq6WlY5EQJbBCt598PkfzGwWPEXyqQ:bPQrJChIP1q
TLSH	T149359E22A2918933D17316B85C1BD79D983EBF103A78D49A6FE71E4C4F792417C2CA87
TrID	30.5% (.SCR) Windows screen saver (13097/50/3) 24.5% (.EXE) Win64 Executable (generic) (10523/12/4) 15.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 10.5% (.EXE) Win32 Executable (generic) (4504/4/1) 4.8% (.EXE) Win16/32 Executable Delphi generic (2072/23)
File icon (PE):
dhash icon	e0c4a2a2a4acbcd8 (11 x Formbook, 7 x SnakeKeylogger, 6 x RemcosRAT)
Reporter	malwarelabnet
Tags:	exe remcos RemcosRAT

Intelligence

File Origin

# of uploads :

# of downloads :

437

Origin country :

Vendor Threat Intelligence

Malware family:

remcos

ID:

File name:

95311fc0f7c080fc57155842d9f00c404813f27744c9142dfb785d0bcd410190.exe

Verdict:

Malicious activity

Analysis date:

2024-05-17 14:45:14 UTC

Tags:

dbatloader rat remcos keylogger

Link:

https://app.any.run/tasks/452deeb1-307e-48c2-a652-494d5270d846

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

SecuriteInfo.com.Trojan.DownLoader46.63573.5932.25285.UNOFFICIAL

Gathering data

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Creating a window

DNS request

Connection attempt

Sending an HTTP GET request

Sending a custom TCP request

Launching a process

Creating a process with a hidden window

Creating a file

Searching for the window

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Unauthorized injection to a system process

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

fingerprint keylogger redcap

Link:

https://www.filescan.io/uploads/66476cbe81ea6b1eef44126d/reports/f16621d7-f248-44a9-91ea-8f1e467a9c1c/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/95311fc0f7c080fc57155842d9f00c404813f27744c9142dfb785d0bcd410190

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/b3a71141-043f-4a3e-8bae-6d8850955152

Result

Threat name:

Remcos, DBatLoader

Detection:

malicious

Classification:

rans.troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1443360

Signature

Allocates memory in foreign processes

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Contains functionality to bypass UAC (CMSTPLUA)

Contains functionality to detect sleep reduction / modifications

Contains functionality to register a low level keyboard hook

Contains functionality to steal Chrome passwords or cookies

Contains functionality to steal Firefox passwords or cookies

Contains functionalty to change the wallpaper

Creates a thread in another existing process (thread injection)

Delayed program exit found

Detected Remcos RAT

Detected unpacking (creates a PE file in dynamic memory)

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found malware configuration

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: New RUN Key Pointing to Suspicious Folder

Sigma detected: Remcos

Snort IDS alert for network traffic

Writes to foreign memory regions

Yara detected DBatLoader

Yara detected Remcos RAT

Yara detected UAC Bypass using CMSTP

Behaviour

Behavior Graph:

Download SVG

Score:

95%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/95311fc0f7c080fc57155842d9f00c404813f27744c9142dfb785d0bcd410190

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/95311fc0f7c080fc57155842d9f00c404813f27744c9142dfb785d0bcd410190/

Threat name:

Win32.Backdoor.Remcos

Status:

Malicious

First seen:

2024-05-16 08:26:06 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

19 of 23 (82.61%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=suyr7qhxycapyvyvlbbnt4amibebh4txiterilp3pboqxtkbagia._file

Result

Malware family:

remcos

Score:

10/10

Tags:

family:remcos botnet:remotehost persistence rat

Link:

https://tria.ge/reports/240517-r2z4fscc3x/

Behaviour

Script User-Agent

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Program crash

Adds Run key to start application

Remcos

Malware Config

C2 Extraction:

104.194.152.154:3678

Unpacked files

SH256 hash:

95311fc0f7c080fc57155842d9f00c404813f27744c9142dfb785d0bcd410190

MD5 hash:

4ef725e78d41b96d40ad546b5d92efe9

SHA1 hash:

b8ee90718310eeab41306d79df5f1cc8b02f7f5b

Link:

https://www.unpac.me/results/d51eefb4-fddb-4b62-b3dc-45b39db8ffd2/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/95311fc0f7c080fc57155842d9f00c404813f27744c9142dfb785d0bcd410190

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Borland Create hunting rule
Author:	malware-lu

Rule name:	DebuggerException__SetConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	maldoc_getEIP_method_1 Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

Rule name:	meth_get_eip Create hunting rule
Author:	Willi Ballenthin

Rule name:	shellcode Create hunting rule
Author:	nex
Description:	Matched shellcode byte patterns

Rule name:	ThreadControl__Context Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	without_attachments Create hunting rule
Author:	Antonio Sanchez <asanchez@hispasec.com>
Description:	Rule to detect the no presence of any attachment
Reference:	http://laboratorio.blogs.hispasec.com/

Rule name:	without_urls Create hunting rule
Author:	Antonio Sanchez <asanchez@hispasec.com>
Description:	Rule to detect the no presence of any url
Reference:	http://laboratorio.blogs.hispasec.com/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_NX	Missing Non-Executable Memory Protection	critical
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
MULTIMEDIA_API	Can Play Multimedia	winmm.dll::sndPlaySoundA
WIN32_PROCESS_API	Can Create Process and Threads	kernel32.dll::CloseHandle kernel32.dll::CreateThread
WIN_BASE_API	Uses Win Base API	kernel32.dll::LoadLibraryExA kernel32.dll::LoadLibraryA kernel32.dll::GetStartupInfoA kernel32.dll::GetDiskFreeSpaceA kernel32.dll::GetCommandLineA
WIN_BASE_IO_API	Can Create Files	kernel32.dll::CreateFileA kernel32.dll::DeleteFileA kernel32.dll::GetFileAttributesA kernel32.dll::FindFirstFileA version.dll::GetFileVersionInfoSizeA version.dll::GetFileVersionInfoA
WIN_REG_API	Can Manipulate Windows Registry	advapi32.dll::RegOpenKeyExA advapi32.dll::RegQueryValueExA
WIN_USER_API	Performs GUI Actions	user32.dll::ActivateKeyboardLayout user32.dll::CreateMenu user32.dll::EmptyClipboard user32.dll::FindWindowA user32.dll::OpenClipboard user32.dll::PeekMessageA

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample