MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a02d52f23eb9e8a857c9ed01d81e6220e787a1e2838d42c2734e99bc73cff250. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemcosRAT

Vendor detections: 12

Intelligence 12 IOCs YARA File information Comments

SHA256 hash:	a02d52f23eb9e8a857c9ed01d81e6220e787a1e2838d42c2734e99bc73cff250
SHA3-384 hash:	0e86588729b3a3bce1a1215c0b845722de613bfcac961bb254b6a06a5ee40cee94985f7a2f80bc70f1741b5dabf4107d
SHA1 hash:	ca25e837884d3355ec369ad121d39cbe762e9844
MD5 hash:	dac2d228738044594db0056a0a6fa2fc
humanhash:	vegan-winner-pasta-apart
File name:	DELIVERY.EXE
Download:	download sample
Signature	RemcosRAT Create hunting rule
File size:	936'960 bytes
First seen:	2022-03-05 16:15:26 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	9eee0aa5a8fa1e2c5aa038d471edcf98 (3 x RemcosRAT)
ssdeep	12288:rQXbVWn5JSVgxB6IHeHMHOPrK56eXloSE2p8VMiqCGTNJ:8XxuagxB6IHesYrqTySE2p8V/nG
Threatray	2'041 similar samples on MalwareBazaar
TLSH	T1BA154A52B16988F6C4162A398C6B826454AA7E307E396D4736D43F0D7FBF2C03D2D993
File icon (PE):
dhash icon	b464c4d0f0e8dcd4 (3 x RemcosRAT)
Reporter	cocaman
Tags:	DHL exe RemcosRAT

Intelligence

File Origin

# of uploads :

# of downloads :

236

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/247532/

Detection(s):

Win.Packed.Zbot-9849940-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Creating a window

DNS request

Sending a custom TCP request

Creating a file

Launching a process

Creating a file in the %AppData% subdirectories

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Unauthorized injection to a system process

Result

Malware family:

n/a

Score:

5/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/8284/overview

Behaviour

MalwareBazaar

CheckCmdLine

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

REMCOS

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/8ca947c7-5135-43e8-b60b-786c73391a8d

Result

Threat name:

Remcos

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/951190

Signature

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Contains functionality to steal Chrome passwords or cookies

Contains functionality to steal Firefox passwords or cookies

Creates a thread in another existing process (thread injection)

Delayed program exit found

Drops PE files to the user root directory

Found malware configuration

Injects a PE file into a foreign processes

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: New RUN Key Pointing to Suspicious Folder

Sigma detected: Suspicious Program Location with Network Connections

Writes to foreign memory regions

Yara detected Remcos RAT

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a02d52f23eb9e8a857c9ed01d81e6220e787a1e2838d42c2734e99bc73cff250/

Threat name:

Win32.Trojan.InjectorAGen

Status:

Malicious

First seen:

2022-03-05 16:16:14 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

23 of 27 (85.19%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=uawvf4r6xhukqv6j5ua5qhtcedtypipcqogufqttj2m3y46p6jia._file

Verdict:

malicious

Label(s):

remcos

RemcosRAT

38c2822b3929fe567273c89ddbdc3fb49a750199cd795f36ad6dc29bb614e4c6

RemcosRAT

6a4b5aab71a352d6ae6140f99a28b0c38df78a8985b3383f1bc424ca74e046fe

RemcosRAT

8dffb14c55c2880b40767aadf5615a6652403d59f357b0b77da3e00b875a0e32

RemcosRAT

b0ac37aec0eef942e0ff9c35828584b8d887f951ec13afbd80cdc4ce23595ae4

RemcosRAT

b53db8cda884be522adeb2f293a41fa80fa2522b3c2eedb1ed20841c5a41d716

RemcosRAT

c530ab34e439bbcaf995290504072a5f77ec085e2ef485e4ef324b7a957f5738

RemcosRAT

d1ececa600d9b37a14dbdee36b5cd58a20932bf976cab21c461c42b96e79f196

RemcosRAT

ebf21217cedcf7f1809418985cb120b150b12d2ec955119c73f7c3170b5f2232

RemcosRAT

+ 2'031 additional samples on MalwareBazaar

Result

Malware family:

remcos

Score:

10/10

Tags:

family:remcos botnet:remotehost persistence rat

Link:

https://tria.ge/reports/220305-tqslcaacgk/

Behaviour

Suspicious use of WriteProcessMemory

Program crash

Adds Run key to start application

Remcos

Malware Config

C2 Extraction:

generem2022.hopto.org:2404
generem1.hopto.org:2404
hendersonk1.hopto.org:2404
gene.ddnsgeek.com:2404
henderson.camdvr.org:2404
henderson1.camdvr.org:2404
hobbyhrs.zapto.org:2404
hobbyhrs2.zapto.org:2404
hobbyhrs1.zapto.org:2404