MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 96d0368486de7d7dff9a894fde1ecc2138fe2cd4835b52d5e03a890d174f29fe. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 15


Intelligence 15 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 96d0368486de7d7dff9a894fde1ecc2138fe2cd4835b52d5e03a890d174f29fe
SHA3-384 hash: e57fb448e3d25eb8bece3e75db9bcf800f62f88fc91ef1597fff3a1ce3bd6bb61ad10f9ae527218d98843f0794c8e906
SHA1 hash: f31499ea411422128840bf4ab2974cb4ceb19627
MD5 hash: 50d0216c89d4f5cbb6168d770be9c72e
humanhash: paris-missouri-idaho-speaker
File name:50d0216c89d4f5cbb6168d770be9c72e.exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:911'872 bytes
First seen:2023-03-01 19:04:52 UTC
Last seen:2023-03-01 20:29:39 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'600 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 12288:qUd7JFXADz1KG1voFO6FJMUicg0lx+IrY0G1ycLT8AK0m2kffIp86YJbItbmJ:X1q1QFVFnB//GA4T8AFm2kfAc
Threatray 58 similar samples on MalwareBazaar
TLSH T12C157CC637BDE122F8E7A1720A1422C93A39B5877211F53B9B37BB519601BFF7689500
TrID 69.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.0% (.EXE) Win64 Executable (generic) (10523/12/4)
6.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.2% (.EXE) Win32 Executable (generic) (4505/5/1)
1.9% (.EXE) Win16/32 Executable Delphi generic (2072/23)
File icon (PE):PE icon
dhash icon 3044b271f0e8e0ba (14 x SnakeKeylogger, 13 x AgentTesla, 4 x Formbook)
Reporter abuse_ch
Tags:exe RemcosRAT

Intelligence

File Origin
# of uploads :
2
# of downloads :
225
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
50d0216c89d4f5cbb6168d770be9c72e.exe
Verdict:
Malicious activity
Analysis date:
2023-03-01 19:31:55 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/904dde64-40b8-47da-bb60-37d7d9cb8cc8

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Remcos
Create hunting rule
Link:
https://www.capesandbox.com/analysis/370944/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.1862.16194.14757.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching cmd.exe command interpreter
Launching a process
Running batch commands
Creating a process with a hidden window
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
67%
Tags:
packed
Link:
https://www.filescan.io/uploads/63ffa1e5bbedb8176ff20746/reports/01ed0f12-2cbf-41da-9acf-0029f10c0f65/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/96d0368486de7d7dff9a894fde1ecc2138fe2cd4835b52d5e03a890d174f29fe
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
REMCOS
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/16014115-8fdc-4120-a8ac-6829cb4fd171
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1185168
Signature
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Contains functionality to capture and log keystrokes
Contains functionality to detect virtual machines (IN, VMware)
Contains functionality to inject code into remote processes
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Creates an autostart registry key pointing to binary in C:\Windows
Detected Remcos RAT
Disables UAC (registry)
Drops executables to the windows directory (C:\Windows) and starts them
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses cmd line tools excessively to alter registry or file data
Uses dynamic DNS services
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Writes to foreign memory regions
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 818023 Sample: M2hgDCU7Jk.exe Startdate: 01/03/2023 Architecture: WINDOWS Score: 100 70 arttronova124.duckdns.org 2->70 76 Malicious sample detected (through community Yara rule) 2->76 78 Multi AV Scanner detection for dropped file 2->78 80 Multi AV Scanner detection for submitted file 2->80 82 7 other signatures 2->82 12 M2hgDCU7Jk.exe 3 2->12         started        16 Windows Audio Service.exe 2 2->16         started        18 Windows Audio Service.exe 2 2->18         started        signatures3 process4 file5 68 C:\Users\user\AppData\...\M2hgDCU7Jk.exe.log, ASCII 12->68 dropped 102 Contains functionality to detect virtual machines (IN, VMware) 12->102 104 Contains functionality to steal Chrome passwords or cookies 12->104 106 Contains functionality to capture and log keystrokes 12->106 112 2 other signatures 12->112 20 M2hgDCU7Jk.exe 1 5 12->20         started        108 Injects a PE file into a foreign processes 16->108 24 Windows Audio Service.exe 16->24         started        110 Drops executables to the windows directory (C:\Windows) and starts them 18->110 27 Windows Audio Service.exe 18->27         started        signatures6 process7 dnsIp8 64 C:\Windows\...\Windows Audio Service.exe, PE32 20->64 dropped 66 Windows Audio Serv...exe:Zone.Identifier, ASCII 20->66 dropped 96 Creates an autostart registry key pointing to binary in C:\Windows 20->96 29 cmd.exe 1 20->29         started        32 cmd.exe 1 20->32         started        74 arttronova124.duckdns.org 79.134.225.119, 3030, 49714, 49716 FINK-TELECOM-SERVICESCH Switzerland 24->74 98 Installs a global keyboard hook 24->98 34 cmd.exe 24->34         started        file9 signatures10 process11 signatures12 114 Uses ping.exe to sleep 29->114 36 Windows Audio Service.exe 3 29->36         started        39 PING.EXE 1 29->39         started        42 conhost.exe 29->42         started        116 Uses cmd line tools excessively to alter registry or file data 32->116 118 Uses ping.exe to check the status of other devices and networks 32->118 44 reg.exe 1 32->44         started        46 conhost.exe 32->46         started        48 conhost.exe 34->48         started        50 reg.exe 34->50         started        process13 dnsIp14 84 Injects a PE file into a foreign processes 36->84 52 Windows Audio Service.exe 2 1 36->52         started        72 127.0.0.1 unknown unknown 39->72 86 Disables UAC (registry) 44->86 signatures15 process16 signatures17 88 Detected Remcos RAT 52->88 90 Writes to foreign memory regions 52->90 92 Allocates memory in foreign processes 52->92 94 Injects a PE file into a foreign processes 52->94 55 cmd.exe 1 52->55         started        58 iexplore.exe 52->58         started        process18 signatures19 100 Uses cmd line tools excessively to alter registry or file data 55->100 60 conhost.exe 55->60         started        62 reg.exe 1 55->62         started        process20
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/96d0368486de7d7dff9a894fde1ecc2138fe2cd4835b52d5e03a890d174f29fe/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2023-03-01 13:53:17 UTC
File Type:
PE (.Net Exe)
Extracted files:
10
AV detection:
18 of 25 (72.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=s3idnbeg3z6x3742rfh54hwmee4p4lguqnnvfvpahkeq2f2pfh7a._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
24c69122ace7d707b1838376111192f2bcdbd02531521b656536773b8bc4710c
RemcosRAT
366d56c69b0267ee6ac2a27cc199911123ed7f511d3e54ac1c69f52236644e84
RemcosRAT
478dba764af2f0d8179f62518b9d675cec897722b4bc9dc75b5bf66cbca0b9a0
RemcosRAT
808af00d1b4ec59a042cfa6d2a46549fca9d2d588847287bab70321622e008cd
RemcosRAT
91855c7204cf7b1a4a56e87b16e5cde14eb8aba073690ca817f2b937130135d6
RemcosRAT
c551529018bda5ce4f1f7c2fbbebad88a1544151676521feb0bb5fcacc4a48be
RemcosRAT
ea46cc06d4376c90836299719c0fb4bdc65e8edfc9fa367d0daa3e7cd3e63e77
RemcosRAT
f530c59ffce92c129896bbe4c2df821ac097d696e2a3f3f99e3bd4aaa5c6ace8
RemcosRAT
+ 48 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:happy new month brand:microsoft evasion persistence phishing rat trojan
Link:
https://tria.ge/reports/230301-xrhz3shc8z/
Behaviour
Enumerates system info in registry
Modifies Internet Explorer settings
Modifies registry class
Modifies registry key
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Program Files directory
Drops file in Windows directory
Detected potential entity reuse from brand microsoft.
Suspicious use of SetThreadContext
Adds Run key to start application
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Remcos
UAC bypass
Malware Config
C2 Extraction:
arttronova124.duckdns.org:3030
Unpacked files
SH256 hash:
11694796af9ba57c2cb49798d12a71f4b27ba612ffacb31aa483d8cd58452b58
MD5 hash:
373a59eaa2e1ac8eb4a78497ca1ddb2f
SHA1 hash:
faf9f8353bca99bc59a4cd6de1a8adc9b27fbccd
Link:
https://www.unpac.me/results/1b6aeb38-1e17-4d33-8e7f-da5b196159d9/
SH256 hash:
1bab001c090f2f208e39247f8eeaeb77a0740bc9be7fa755cd57a863b3d22dd3
MD5 hash:
90b3109cf9cc5342015fc1583a78b282
SHA1 hash:
bdddff1c96296a0dc9f8d808e3b2d5829a15d2d2
Link:
https://www.unpac.me/results/1b6aeb38-1e17-4d33-8e7f-da5b196159d9/
SH256 hash:
a0bfd53114249acc61286c046c572687f4f57701adb780287b4c3d56a48154b6
MD5 hash:
b1c3c147639ab387d24cb6984ad633cd
SHA1 hash:
ba3a65cecd2a7a6f1bacee7d1180435b01f32cc8
Link:
https://www.unpac.me/results/1b6aeb38-1e17-4d33-8e7f-da5b196159d9/
SH256 hash:
e73bfdb9f5a8ae04fcc1dc19acfb3b491ea9f9979d47a36d08d0eba546b42eef
MD5 hash:
a96ff5f080029bda912f21b8d5386650
SHA1 hash:
9f50742a569ba555d1781833bc31bddcf411f045
Detections:
Remcos
Create hunting rule
win_remcos_auto
Create hunting rule
win_remcos_g0
Create hunting rule
Link:
https://www.unpac.me/results/1b6aeb38-1e17-4d33-8e7f-da5b196159d9/
Parent samples :
96d0368486de7d7dff9a894fde1ecc2138fe2cd4835b52d5e03a890d174f29fe
b66c50211263d233738e04d25bc0d59bdcdb522d2178bf94d95094df6d329aec
9367f2fed062c994290b2eff35d3560ead41338e9879d15ec49df4c7e8acd358
SH256 hash:
8f0c7e3047346b8d6477ff6d4639fd6157602c7ebc840f3432b99263f1cb415c
MD5 hash:
e5b073b30db1b058298f5df032164e4d
SHA1 hash:
15d3ada4e7ac01b766615b9b66785e7e2ae9b0ca
Link:
https://www.unpac.me/results/1b6aeb38-1e17-4d33-8e7f-da5b196159d9/
SH256 hash:
96d0368486de7d7dff9a894fde1ecc2138fe2cd4835b52d5e03a890d174f29fe
MD5 hash:
50d0216c89d4f5cbb6168d770be9c72e
SHA1 hash:
f31499ea411422128840bf4ab2974cb4ceb19627
Link:
https://www.unpac.me/results/1b6aeb38-1e17-4d33-8e7f-da5b196159d9/
Malware family:
Remcos
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/96d0368486de/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/96d0368486de7d7dff9a894fde1ecc2138fe2cd4835b52d5e03a890d174f29fe

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RemcosRAT

Executable exe 96d0368486de7d7dff9a894fde1ecc2138fe2cd4835b52d5e03a890d174f29fe

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/370944/
  
URLhaus
https://urlhaus.abuse.ch/url/2272201/
  
Delivery method
Distributed via web download

Comments