MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9cc4f322829670b8678fb4c0aaffbef51491c3b4530d561443b4b59d1978c7b3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 9


Intelligence 9 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9cc4f322829670b8678fb4c0aaffbef51491c3b4530d561443b4b59d1978c7b3
SHA3-384 hash: 94a19fd4cf7c02665ffc6931675de8f16eec0ef95b3deafa92db3c460a2b876514655fbeada6acaefcd8e7ac6c1f9d57
SHA1 hash: afdfd6dd18862254f092274bfeafc4572ccbf156
MD5 hash: 5f9c84bf870295e69c72a9ff6284f407
humanhash: golf-mango-video-skylark
File name:for_testing_ofSXbx.msi
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:4'014'592 bytes
First seen:2023-09-26 08:21:13 UTC
Last seen:2023-09-26 08:41:06 UTC
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 98304:PYZdVAWWlLuKn4messQdqSqkxbpYlXLL:iglLlsHSfxVYVL
Threatray 1 similar samples on MalwareBazaar
TLSH T1BD0602227696C63BD56E0270252DE77F417DBD700BB284DB63C82A1E2E728C25336E57
TrID 80.0% (.MSI) Microsoft Windows Installer (454500/1/170)
10.7% (.MST) Windows SDK Setup Transform script (61000/1/5)
7.8% (.MSP) Windows Installer Patch (44509/10/5)
1.4% (.) Generic OLE2 / Multistream Compound (8000/1)
Reporter JAMESWT_WT
Tags:89-23-100-222 msi remcos RemcosRAT

Intelligence

File Origin
# of uploads :
2
# of downloads :
113
Origin country :
IT IT
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/451206/
Detection(s):
SecuriteInfo.com.Win32.Agent-BDNK.26694.30936.UNOFFICIAL
Create hunting rule

Verdict:
No Threat
Threat level:
  10/10
Confidence:
100%
Tags:
control lolbin remote shell32
Link:
https://www.filescan.io/uploads/651294ad33582f234e0352b1/reports/a6471882-d018-4c48-8d7f-a1b7513fa2aa/overview
Verdict:
Malicious
Labled as:
Malware
Link:
https://www.hybrid-analysis.com/sample/9cc4f322829670b8678fb4c0aaffbef51491c3b4530d561443b4b59d1978c7b3
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/1314361
Signature
Antivirus detection for URL or domain
Bypasses PowerShell execution policy
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1314361 Sample: for_testing_ofSXbx.msi Startdate: 26/09/2023 Architecture: WINDOWS Score: 72 46 Antivirus detection for URL or domain 2->46 48 Multi AV Scanner detection for dropped file 2->48 50 Multi AV Scanner detection for submitted file 2->50 9 msiexec.exe 27 47 2->9         started        12 msiexec.exe 2 2->12         started        process3 file4 32 C:\Windows\Installer\MSI6C63.tmp, PE32 9->32 dropped 34 C:\Windows\Installer\MSI6B67.tmp, PE32 9->34 dropped 36 C:\Windows\Installer\MSI6B47.tmp, PE32 9->36 dropped 38 13 other files (6 malicious) 9->38 dropped 14 msiexec.exe 8 9->14         started        18 ICQ.exe 1 9->18         started        process5 file6 40 C:\Users\user\AppData\Local\...\scr6C8F.txt, Unicode 14->40 dropped 42 C:\Users\user\AppData\Local\...\scr6C8E.ps1, Unicode 14->42 dropped 44 C:\Users\user\AppData\Local\...\pss6C90.ps1, Unicode 14->44 dropped 52 Bypasses PowerShell execution policy 14->52 20 powershell.exe 18 14->20         started        54 Maps a DLL or memory area into another process 18->54 22 cmd.exe 3 18->22         started        signatures7 process8 process9 24 cmd.exe 1 2 20->24         started        26 conhost.exe 20->26         started        28 conhost.exe 22->28         started        process10 30 conhost.exe 24->30         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9cc4f322829670b8678fb4c0aaffbef51491c3b4530d561443b4b59d1978c7b3/
Threat name:
Win32.Trojan.Rugmi
Create hunting rule
Status:
Malicious
First seen:
2023-09-26 08:12:51 UTC
File Type:
Binary (Archive)
Extracted files:
180
AV detection:
10 of 23 (43.48%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ttcpgiucszylqz4pwtakv7566ukjdq5ukmgvmfcdws2z2glyy6zq._file
Verdict:
unknown
Similar samples:
2227d5b2e2782a03bdb847a8ebf9ea40cc2c9f10f48385154c66ded1577b1deb
RemcosRAT
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:remotehost rat
Link:
https://tria.ge/reports/230926-j9la9sff8w/
Behaviour
Checks SCSI registry key(s)
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Uses Volume Shadow Copy service COM API
Enumerates physical storage devices
Drops file in Windows directory
Drops file in System32 directory
Suspicious use of SetThreadContext
Enumerates connected drives
Executes dropped EXE
Loads dropped DLL
Remcos
Malware Config
C2 Extraction:
85.209.176.106:2404
Malware family:
Remcos
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/9cc4f3228296/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Remcos
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/9cc4f322829670b8678fb4c0aaffbef51491c3b4530d561443b4b59d1978c7b3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:maldoc_OLE_file_magic_number
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:suspicious_msi_file
Create hunting rule
Author:Johnk3r
Description:Detects common strings, DLL and API in Banker_BR

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RemcosRAT

Microsoft Software Installer (MSI) msi 9cc4f322829670b8678fb4c0aaffbef51491c3b4530d561443b4b59d1978c7b3

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/451206/
  
URLhaus
https://urlhaus.abuse.ch/url/2713963/
  
Delivery method
Distributed via web download

Comments