MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9a8c41228b0c201d956ec0c6612e978438c403759d6e1fa0b33e63c3375e3c56. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 11


Intelligence 11 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9a8c41228b0c201d956ec0c6612e978438c403759d6e1fa0b33e63c3375e3c56
SHA3-384 hash: 405353aa7e7784d40bbd22fa4b353324dc34f0efa0cd948a04b3c27fab5f51a493bde9189e92e2427c7bdcf5f397879b
SHA1 hash: a700e3715f468b8de5701dc827ff27bb87de0a61
MD5 hash: ca82a7aeed1c8528c1029068fa157c70
humanhash: south-october-single-cup
File name:Re Confirmación de pedido-5308,pdf.exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:943'104 bytes
First seen:2021-08-14 06:46:57 UTC
Last seen:2021-08-14 07:57:08 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 264119802652cdddc9dfa92f43e47592 (2 x RemcosRAT, 1 x BitRAT)
ssdeep 12288:vR5anu6FdTnaTS/hCurCWE86pS7YfwLTAWNFzJCfU2QZxEb8+KLA1y:vRsnrTnaOwu+3g06TLNFzv2Vb8+dy
Threatray 438 similar samples on MalwareBazaar
TLSH T1EB157DA794504472D33B353E982B775EFD587E150EB82885BEFEA90C4D7DB80290A1CB
dhash icon 5eded94cde3c0104 (2 x RemcosRAT, 1 x BitRAT)
Reporter abuse_ch
Tags:exe RemcosRAT

Intelligence

File Origin
# of uploads :
2
# of downloads :
153
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Re Confirmación de pedido-5308,pdf.exe
Verdict:
Malicious activity
Analysis date:
2021-08-14 07:13:02 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/738df136-1268-4742-bc95-5407a556e23d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Trojan.DownLoader41.11469.8929.31814.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
DNS request
Connection attempt
Sending a custom TCP request
Creating a file
Deleting a recently created file
Launching a process
Connection attempt to an infection source
Creating a process from a recently created file
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Query of malicious DNS domain
Unauthorized injection to a system process
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
REMCOS
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/ef3a837d-b376-4fd8-bf03-9e15fd678064
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/832779
Signature
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Creates a thread in another existing process (thread injection)
Delayed program exit found
Detected Remcos RAT
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Uses dynamic DNS services
Writes to foreign memory regions
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 465210 Sample: Re Confirmaci#U00f3n de ped... Startdate: 14/08/2021 Architecture: WINDOWS Score: 100 30 thankyoulord4real.ddns.net 2->30 54 Found malware configuration 2->54 56 Malicious sample detected (through community Yara rule) 2->56 58 Multi AV Scanner detection for submitted file 2->58 60 5 other signatures 2->60 7 Re Confirmaci#U00f3n de pedido-5308,pdf.exe 1 19 2->7         started        12 Grgkkdy.exe 16 2->12         started        14 Grgkkdy.exe 16 2->14         started        signatures3 process4 dnsIp5 32 onedrive.live.com 7->32 34 fuqgaq.dm.files.1drv.com 7->34 36 dm-files.fe.1drv.com 7->36 24 C:\Users\Public\Libraries\...behaviorgraphrgkkdy.exe, PE32 7->24 dropped 62 Writes to foreign memory regions 7->62 64 Creates a thread in another existing process (thread injection) 7->64 66 Injects a PE file into a foreign processes 7->66 16 dialer.exe 2 7->16         started        38 onedrive.live.com 12->38 42 2 other IPs or domains 12->42 68 Multi AV Scanner detection for dropped file 12->68 70 Machine Learning detection for dropped file 12->70 20 logagent.exe 12->20         started        40 onedrive.live.com 14->40 44 2 other IPs or domains 14->44 22 dialer.exe 14->22         started        file6 signatures7 process8 dnsIp9 26 thankyoulord4real.ddns.net 185.19.85.140, 3030, 49744, 49747 DATAWIRE-ASCH Switzerland 16->26 28 192.168.2.1 unknown unknown 16->28 46 Contains functionality to steal Chrome passwords or cookies 16->46 48 Contains functionality to inject code into remote processes 16->48 50 Contains functionality to steal Firefox passwords or cookies 16->50 52 Delayed program exit found 20->52 signatures10
Detection:
remcos
Create hunting rule
Link:
https://mwdb.cert.pl/sample/9a8c41228b0c201d956ec0c6612e978438c403759d6e1fa0b33e63c3375e3c56/
Threat name:
Win32.Trojan.Woreflint
Create hunting rule
Status:
Malicious
First seen:
2021-08-14 01:58:31 UTC
AV detection:
9 of 28 (32.14%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tkgeciulbqqb3floyddgcluxqq4mia3vtvxb7ifthzr4gn26hrla._file
Verdict:
malicious
Similar samples:
10f675a780a5814df0a79b673213a2ed2989816a517797df5656551b0819789c
RemcosRAT
39f47c4612520d9844a152198245ee842bdf40de4c65e35c03771252f7d7b381
RemcosRAT
4c0c348d5fe6d35084087f5df83a5d5f15aa75a30b1dc37204f701383a7685eb
RemcosRAT
62960caf3d007638be89631e502733f30c42a9ba0269e8c00457c9dec10e9136
RemcosRAT
7a97f05df11f826ba1d973f260a565584d9db207a8130cf2769d0156078cc944
RemcosRAT
8d076437949873b971f9534e630ebe26a8437f50786c430eaeb46c71d53a88e5
RemcosRAT
cb5bbf44295f0df808a863306cff28a7237ceda45a417d90f7eaa6176b0d6047
RemcosRAT
fad40e1841789cfbef3c9f09b4e557b928597506cd8b93d8eae51cef2ba3cf3f
RemcosRAT
ffe17f71c718c4e0aaa10a1154e503ffdcf5382207795aca69009aaf3fea28f4
RemcosRAT
+ 428 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:e sure 4 me persistence rat
Link:
https://tria.ge/reports/210814-pw5hfnmtax/
Behaviour
Suspicious use of WriteProcessMemory
Adds Run key to start application
Remcos
Malware Config
C2 Extraction:
thankyoulord4real.ddns.net:3030
Unpacked files
SH256 hash:
795b2b5d6668147d7924ac96f90741ddc2a2b5003f455fb842b613a286fbf8fc
MD5 hash:
53011b69a7231aea23d66805a681144b
SHA1 hash:
e3d0d157e763c865e79ccc5bedc2fd5fd90413f7
Link:
https://www.unpac.me/results/6c4d9592-95bf-4d4c-810f-e5efab7cd8d1/
SH256 hash:
9a8c41228b0c201d956ec0c6612e978438c403759d6e1fa0b33e63c3375e3c56
MD5 hash:
ca82a7aeed1c8528c1029068fa157c70
SHA1 hash:
a700e3715f468b8de5701dc827ff27bb87de0a61
Link:
https://www.unpac.me/results/6c4d9592-95bf-4d4c-810f-e5efab7cd8d1/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/9a8c41228b0c/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9a8c41228b0c201d956ec0c6612e978438c403759d6e1fa0b33e63c3375e3c56

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments