MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 958e5d7947f48f2047ac3c595ee724a916c9969430731091ac1b9fcfaaf65d70. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 17


Intelligence 17 IOCs 1 YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 958e5d7947f48f2047ac3c595ee724a916c9969430731091ac1b9fcfaaf65d70
SHA3-384 hash: 586b51a05125f52ac4ad487caa96e01589068c215c08ab52fbc87940fa6737ebe074eb2691a7329cc3cef61d0ff95547
SHA1 hash: 3f3c04d941792d7598bc6e1fb1814c44ca3d1cf4
MD5 hash: 4e6fb77e41ce6e4e8ddec2a04c51b135
humanhash: cat-robert-carbon-music
File name:FACF9877656789000.bat.exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'287'075 bytes
First seen:2024-11-06 11:10:28 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 890e522b31701e079a367b89393329e6 (25 x Formbook, 12 x AgentTesla, 8 x Loda)
ssdeep 24576:tthEVaPqLopaxpymFCZqtRGGAsL4+ktZuStEJz992or8rekadSfU84w:VEVUcI0pyrwtRGGA6mgStLo8uEf
Threatray 1'167 similar samples on MalwareBazaar
TLSH T14E553379794AD02DF8E427FDEE836550D684FA0312F9E67F70B92B026A0B501FE19D81
TrID 86.7% (.EXE) AutoIt3 compiled script executable (510622/80/67)
4.5% (.EXE) UPX compressed Win32 Executable (27066/9/6)
4.5% (.EXE) Win32 EXE Yoda's Crypter (26569/9/4)
1.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
0.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
Magika pebin
File icon (PE):PE icon
dhash icon b150b26869b2d471 (468 x Formbook, 101 x RedLineStealer, 94 x AgentTesla)
Reporter abuse_ch
Tags:exe RAT RemcosRAT


Avatar
abuse_ch
RemcosRAT C2:
192.3.101.137:8780

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
192.3.101.137:8780 https://threatfox.abuse.ch/ioc/1341361/

Intelligence

File Origin
# of uploads :
1
# of downloads :
522
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
FACF9877656789000.bat.exe
Verdict:
Suspicious activity
Analysis date:
2024-11-06 11:11:06 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/3933a066-7f07-4349-b15d-e7c0fe0660f9

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.W32.Graftor.FU.gen.Eldorado.8651.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PSW.Banker6.BTQY.1690.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=672b51e28d23d904913438bc
Tags:
autorun autoit remcos emotet
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Creating a file in the %temp% directory
Creating a file
Creating a process from a recently created file
Launching a process
Сreating synchronization primitives
Connection attempt
Sending a custom TCP request
DNS request
Reading critical registry keys
Stealing user critical data
Enabling autorun by creating a file
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
autoit compiled-script masquerade microsoft_visual_cc overlay packed packed packed packer_detected remcos upx
Link:
https://www.filescan.io/uploads/672b4ecbc7967d5267a8fcba/reports/921cae02-5704-4c2a-a105-30cdf71a5ad0/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_70%
Link:
https://www.hybrid-analysis.com/sample/958e5d7947f48f2047ac3c595ee724a916c9969430731091ac1b9fcfaaf65d70
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
REMCOS
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/6321772f-e77d-4ff6-80a0-abe15c68f2a1
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
rans.phis.troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1550065
Signature
AI detected suspicious sample
C2 URLs / IPs found in malware configuration
Contains functionality to bypass UAC (CMSTPLUA)
Contains functionality to inject code into remote processes
Contains functionality to register a low level keyboard hook
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Contains functionalty to change the wallpaper
Delayed program exit found
Detected Remcos RAT
Drops VBS files to the startup folder
Found malware configuration
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Drops script at startup location
Sigma detected: Remcos
Sigma detected: WScript or CScript Dropper
Suricata IDS alerts for network traffic
Switches to a custom stack to bypass stack traces
System process connects to network (likely due to code injection or exploit)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file / registry access)
Tries to steal Mail credentials (via file registry)
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Yara detected Remcos RAT
Yara detected UAC Bypass using CMSTP
Yara detected WebBrowserPassView password recovery tool
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1550065 Sample: FACF9877656789000.bat.exe Startdate: 06/11/2024 Architecture: WINDOWS Score: 100 58 geoplugin.net 2->58 64 Suricata IDS alerts for network traffic 2->64 66 Found malware configuration 2->66 68 Malicious sample detected (through community Yara rule) 2->68 70 10 other signatures 2->70 12 FACF9877656789000.bat.exe 3 2->12         started        15 wscript.exe 1 2->15         started        signatures3 process4 file5 56 C:\Users\user\AppData\...\selectedly.exe, PE32 12->56 dropped 18 selectedly.exe 1 12->18         started        112 Windows Scripting host queries suspicious COM object (likely to drop second stage) 15->112 22 selectedly.exe 15->22         started        signatures6 process7 file8 52 C:\Users\user\AppData\...\selectedly.vbs, data 18->52 dropped 72 Multi AV Scanner detection for dropped file 18->72 74 Machine Learning detection for dropped file 18->74 76 Drops VBS files to the startup folder 18->76 78 Switches to a custom stack to bypass stack traces 18->78 24 selectedly.exe 18->24         started        26 svchost.exe 18->26         started        80 Writes to foreign memory regions 22->80 82 Maps a DLL or memory area into another process 22->82 29 svchost.exe 22->29         started        signatures9 process10 signatures11 31 selectedly.exe 24->31         started        33 svchost.exe 24->33         started        88 Contains functionality to bypass UAC (CMSTPLUA) 26->88 90 Tries to steal Mail credentials (via file registry) 26->90 92 Contains functionalty to change the wallpaper 26->92 96 5 other signatures 26->96 94 Detected Remcos RAT 29->94 process12 process13 35 selectedly.exe 31->35         started        38 svchost.exe 31->38         started        signatures14 84 Writes to foreign memory regions 35->84 86 Maps a DLL or memory area into another process 35->86 40 svchost.exe 3 15 35->40         started        process15 dnsIp16 60 192.3.101.137, 49730, 49732, 8780 AS-COLOCROSSINGUS United States 40->60 62 geoplugin.net 178.237.33.50, 49731, 80 ATOM86-ASATOM86NL Netherlands 40->62 54 C:\ProgramData\remcos\logs.dat, data 40->54 dropped 98 System process connects to network (likely due to code injection or exploit) 40->98 100 Detected Remcos RAT 40->100 102 Maps a DLL or memory area into another process 40->102 104 Installs a global keyboard hook 40->104 45 svchost.exe 1 40->45         started        48 svchost.exe 1 40->48         started        50 svchost.exe 2 40->50         started        file17 signatures18 process19 signatures20 106 Tries to steal Instant Messenger accounts or passwords 45->106 108 Tries to harvest and steal browser information (history, passwords, etc) 45->108 110 Tries to steal Mail credentials (via file / registry access) 48->110
Score:
98%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/958e5d7947f48f2047ac3c595ee724a916c9969430731091ac1b9fcfaaf65d70
Detection:
remcos
Create hunting rule
Link:
https://mwdb.cert.pl/sample/958e5d7947f48f2047ac3c595ee724a916c9969430731091ac1b9fcfaaf65d70/
Threat name:
Win32.Trojan.Autoitinject
Create hunting rule
Status:
Malicious
First seen:
2024-11-06 11:11:05 UTC
File Type:
PE (Exe)
Extracted files:
54
AV detection:
25 of 38 (65.79%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=swhf26kh6shsar5mhrmv5zzevelmtfuugbzrbenmdop47kxwlvya._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
unknown_loader_036
Create hunting rule
admintool_powerrun
Create hunting rule
Similar samples:
23b2114fcff390c980792af42dcfc756a257a3d0b0a65e893ae7c90091549b4f
RemcosRAT
2b37e00ad7357cc5c143361ac3117ac868e448ed36a3e263f6996957b9d830f2
RemcosRAT
8d83a9a3bbd6e63e37b6d66c4febdbcf17a48fe77fabdd52c5bfa01a661a33da
RemcosRAT
b51301458382fec98cc0312e1849937ff1294f9aa86de165356c5c0207ec85ce
RemcosRAT
ca690123d14bd3632ab53a076f8bfb7bd2176248af6b735af9719aca77a024b5
RemcosRAT
e5aebbb2c6ad445d5a2ee5c33a77d8ecfe74cf206433b723736e2e88b9b5d78f
RemcosRAT
error
RemcosRAT
+ 1'157 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:remotehost collection discovery rat upx
Link:
https://tria.ge/reports/241106-m99kms1pck/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
System Location Discovery: System Language Discovery
AutoIT Executable
Suspicious use of SetThreadContext
UPX packed file
Accesses Microsoft Outlook accounts
Drops startup file
Executes dropped EXE
Loads dropped DLL
Detected Nirsoft tools
NirSoft MailPassView
NirSoft WebBrowserPassView
Remcos
Remcos family
Malware Config
C2 Extraction:
192.3.101.137:8780
Verdict:
Suspicious
Tags:
trojan
YARA:
MAL_Malware_Imphash_Mar23_1
Link:
https://app.threat.zone/submission/8c600eb5-d724-4e46-ba2c-1f48189e2f4c
Unpacked files
SH256 hash:
83f4ac0157bf747c85d5bbce6ce3099e0861ce7cab40cfeeba282d4c4313d497
MD5 hash:
b175c6f76f144025ac54e99ea308178d
SHA1 hash:
eda0d90aa2a0fe7ea823e8fe6a4db6b5f06f2149
Detections:
AutoIT_Compiled
Create hunting rule
Link:
https://www.unpac.me/results/bb9de326-3aab-4439-9819-63d7e781e73d/
Parent samples :
ca690123d14bd3632ab53a076f8bfb7bd2176248af6b735af9719aca77a024b5
bea0911280cb4fef061dc70fe4fbb4f5c89716ac6d05b7bd383ae593da116d1d
0812c989fb4ccd9ecc95deacd727da799b88ae487e0edd4dcee900429a420065
4237d59dc3ae1263c38b45de37e7f6d5a13223cb2166fea0394a5593dd7f5520
b43ad962fd2871e8d704ed4b44f719dee7793e90387563292fe48744d86a4e54
958e5d7947f48f2047ac3c595ee724a916c9969430731091ac1b9fcfaaf65d70
77db8dd22b4534f98b39125e98d0aa8448bae16313b61d18383c420569f6af7a
ab158b7e9b371e301d2554b7eb3f6363cdc88efc65397343d3ef179db7e0d68a
996a678b9f2d2434c6da9452449c3f21aac4b5e15ba7ae8c0a5ecd429d287e35
dd6f99ed2cc3586d2af65cc1b359ccfa3448cde53ca4465f9ffe3e8bc4c86e12
8f1be325faa69592642419a3ce86343a7b484853d0a1b27bd769f8435be85381
0a0777441380c8bff668c4ef87b88334f9b26c3d45f3a9b2a4059cc893cb3244
57be4ec7980a2d28a02541067688d47feecf59e71fdb022aa93fe84c04429c55
SH256 hash:
61b20f0bb455ef420bee49392c242dab2de117e209f1e3f4830e6c97f06671b1
MD5 hash:
291c46761093929b16947a758ce355fe
SHA1 hash:
37c0fee23e54de0ce328c7624e974da0284629b4
Detections:
Remcos
Create hunting rule
win_remcos_auto
Create hunting rule
win_remcos_w0
Create hunting rule
malware_windows_remcos_rat
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
Create hunting rule
win_remcos_rat_unpacked
Create hunting rule
Link:
https://www.unpac.me/results/bb9de326-3aab-4439-9819-63d7e781e73d/
SH256 hash:
958e5d7947f48f2047ac3c595ee724a916c9969430731091ac1b9fcfaaf65d70
MD5 hash:
4e6fb77e41ce6e4e8ddec2a04c51b135
SHA1 hash:
3f3c04d941792d7598bc6e1fb1814c44ca3d1cf4
Link:
https://www.unpac.me/results/bb9de326-3aab-4439-9819-63d7e781e73d/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MAL_Malware_Imphash_Mar23_1
Create hunting rule
Author:Arnim Rupp
Description:Detects malware by known bad imphash or rich_pe_header_hash
Reference:https://yaraify.abuse.ch/statistics/
Rule name:UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser
Create hunting rule
Author:malware-lu
Rule name:UPXv20MarkusLaszloReiser
Create hunting rule
Author:malware-lu
Rule name:upx_largefile
Create hunting rule
Author:k3nr9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
AUTH_APIManipulates User AuthorizationADVAPI32.dll::GetAce
MULTIMEDIA_APICan Play MultimediaWINMM.dll::timeGetTime
WIN_BASE_APIUses Win Base APIKERNEL32.DLL::LoadLibraryA

Comments