MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a11f84458eb6e2663905a5f98596fb495ae8b813cd28f3cda787377976168453. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 15


Intelligence 15 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a11f84458eb6e2663905a5f98596fb495ae8b813cd28f3cda787377976168453
SHA3-384 hash: e92e762728c16191c534955f5c23dd5be37baf7ef120c803a987670cdbd9bada90724c33fdc173b03ca4e9e64fde57d6
SHA1 hash: e5c25d24aa59016d0ad7ff49835b5f3709c966d2
MD5 hash: 134e456fc68f2909d4131e4b90c01511
humanhash: seventeen-september-seven-tango
File name:a11f84458eb6e2663905a5f98596fb495ae8b813cd28f3cda787377976168453
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:973'312 bytes
First seen:2023-07-07 09:40:14 UTC
Last seen:2023-07-07 10:38:55 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 24576:KdvDcAwXGzXaPyjkcJZHQ9PopGhWM21Z2Wqc+0GmeXmin+o:KdvQRXaaYkOZHQhoAWM21Z2Wqc+73n+o
Threatray 2'195 similar samples on MalwareBazaar
TLSH T1AF25225473BE8B22E6F387F59890927163376C497922D35E4ECB70EA6722F020351D6B
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter adrian__luca
Tags:exe RemcosRAT

Intelligence

File Origin
# of uploads :
2
# of downloads :
280
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
a11f84458eb6e2663905a5f98596fb495ae8b813cd28f3cda787377976168453
Verdict:
Malicious activity
Analysis date:
2023-07-07 09:40:19 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/c8416257-61cf-461c-9b7d-968ac6d86746

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Remcos
Create hunting rule
Link:
https://www.capesandbox.com/analysis/410447/
Detection(s):
SecuriteInfo.com.Trojan.GenericKDS.61012543.5479.20093.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Сreating synchronization primitives
Creating a process with a hidden window
Launching a process
Adding an exclusion to Microsoft Defender
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/64a7ddaf89e309292a8afef2/reports/e968901c-8432-4946-9d35-7f84c7f00a02/overview
Verdict:
Malicious
Labled as:
Trojan.GenericS
Link:
https://www.hybrid-analysis.com/sample/a11f84458eb6e2663905a5f98596fb495ae8b813cd28f3cda787377976168453
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
REMCOS
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/29644be2-8a8d-4c53-9d91-5d88e6d85fc0
Detection:
remcos
Create hunting rule
Link:
https://mwdb.cert.pl/sample/a11f84458eb6e2663905a5f98596fb495ae8b813cd28f3cda787377976168453/
Threat name:
Win32.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2023-06-22 14:38:00 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
16 of 24 (66.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=uepyirmow3rgmoifux4ylfx3jfnoroatzuuphtnhq43xs5qwqrjq._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
12eb9e0af8b7e3b90436a78fd09aed23c6f4eef1f9bc7761a83469e4310c93b5
RemcosRAT
2b4c534df5fe4c7ee7a402f384109cb60b54c7f301ef8644e7b1eba397d89f2b
RemcosRAT
30aa6ed4bf80553de2406b91601d215de6ea9f682af906e83c5e7773c8d13037
RemcosRAT
6053c5c3a4202b8c2e6b2f176a99c980233f63024be06b67d3a30e2f0b4470f4
RemcosRAT
61dd5ffe6eae5f4bfa7299b37a7c0dea469d76b698200126cafc14a45acc1ba2
RemcosRAT
9271b609db698f886795f121d1d110acf0a4959eaf5d94a93ade96b6a6cf0a95
RemcosRAT
cadf95355bd6ea18fdd3555ea3f85d102f40b3df0dc36b332f9ad8b505105f6e
RemcosRAT
dc091920175bd059d2925977e1806df9930c40db5292a73158bac390fca03d75
RemcosRAT
+ 2'185 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:remotehost collection persistence rat spyware stealer
Link:
https://tria.ge/reports/230707-lnrx2agb94/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Suspicious use of SetThreadContext
Accesses Microsoft Outlook accounts
Adds Run key to start application
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
NirSoft MailPassView
NirSoft WebBrowserPassView
Nirsoft
Remcos
Malware Config
C2 Extraction:
45.139.105.174:2210
212.193.30.230:6320
212.193.30.230:2286
212.193.30.230:3330
Unpacked files
SH256 hash:
52f358d201e81d3a0391cedd3042e2f957555b77aa49559f7fb810bbb7673ba1
MD5 hash:
c785ddc46141af772c75101d17c46a41
SHA1 hash:
e248723b6f60cc7607980d07172b64c33b2b2f15
Link:
https://www.unpac.me/results/9148c001-3e19-4945-933a-ad88e251bb5d/
SH256 hash:
533444f4a2ac259ac9956887c185846c996b55125fb1eb967b9bad4b726c4d34
MD5 hash:
2162832183698ff825e74f506727273e
SHA1 hash:
b2fdec77360c0760d2eaf81f3141c002f6518f2d
Link:
https://www.unpac.me/results/9148c001-3e19-4945-933a-ad88e251bb5d/
SH256 hash:
66a89b7b82a654436de27488797d01bc94504f74aca673b3888328d91e8559e8
MD5 hash:
67782bb05e9dfd3064210871fac14389
SHA1 hash:
8d763451f532b2383461891d7f220a06d6ef1d8c
Link:
https://www.unpac.me/results/9148c001-3e19-4945-933a-ad88e251bb5d/
SH256 hash:
e6ecc640876e676a08ee2d1b9e8e06329930dea9c4319fe6502dc5a9c9e14d35
MD5 hash:
be0604a399ab6ba90dd0519e33bd32a8
SHA1 hash:
353f916d2674aa66fe0b06e0b70f42231de3b52d
Detections:
Remcos
Create hunting rule
win_remcos_auto
Create hunting rule
Remcos
Create hunting rule
win_remcos_auto
Create hunting rule
Remcos
Create hunting rule
win_remcos_auto
Create hunting rule
Remcos
Create hunting rule
win_remcos_auto
Create hunting rule
Remcos
Create hunting rule
win_remcos_auto
Create hunting rule
Link:
https://www.unpac.me/results/9148c001-3e19-4945-933a-ad88e251bb5d/
Parent samples :
814e073523aed94d4433e76ef0d0ecaa94224313fb4e54e6716b26e22f06e5ac
d930e3006b889c13cdebe9004c021ed18ebe31f1504ffce27f10277e439329e0
e5349a064403917e3f1c3aa1cb2f18e4a09477242eb9f7bee5a80c724b1a49ab
a11f84458eb6e2663905a5f98596fb495ae8b813cd28f3cda787377976168453
SH256 hash:
fcd9a285076c520c73421fa9b0456c06cdbb3c087481f167e6bd5b18555dc191
MD5 hash:
bc1c82571e046deac0795f832966fda6
SHA1 hash:
76a5bf8577374c9e61abc76f4ba88ee044580525
Link:
https://www.unpac.me/results/9148c001-3e19-4945-933a-ad88e251bb5d/
SH256 hash:
52f358d201e81d3a0391cedd3042e2f957555b77aa49559f7fb810bbb7673ba1
MD5 hash:
c785ddc46141af772c75101d17c46a41
SHA1 hash:
e248723b6f60cc7607980d07172b64c33b2b2f15
Link:
https://www.unpac.me/results/9148c001-3e19-4945-933a-ad88e251bb5d/
SH256 hash:
533444f4a2ac259ac9956887c185846c996b55125fb1eb967b9bad4b726c4d34
MD5 hash:
2162832183698ff825e74f506727273e
SHA1 hash:
b2fdec77360c0760d2eaf81f3141c002f6518f2d
Link:
https://www.unpac.me/results/9148c001-3e19-4945-933a-ad88e251bb5d/
SH256 hash:
66a89b7b82a654436de27488797d01bc94504f74aca673b3888328d91e8559e8
MD5 hash:
67782bb05e9dfd3064210871fac14389
SHA1 hash:
8d763451f532b2383461891d7f220a06d6ef1d8c
Link:
https://www.unpac.me/results/9148c001-3e19-4945-933a-ad88e251bb5d/
SH256 hash:
e6ecc640876e676a08ee2d1b9e8e06329930dea9c4319fe6502dc5a9c9e14d35
MD5 hash:
be0604a399ab6ba90dd0519e33bd32a8
SHA1 hash:
353f916d2674aa66fe0b06e0b70f42231de3b52d
Detections:
Remcos
Create hunting rule
win_remcos_auto
Create hunting rule
Remcos
Create hunting rule
win_remcos_auto
Create hunting rule
Remcos
Create hunting rule
win_remcos_auto
Create hunting rule
Remcos
Create hunting rule
win_remcos_auto
Create hunting rule
Remcos
Create hunting rule
win_remcos_auto
Create hunting rule
Link:
https://www.unpac.me/results/9148c001-3e19-4945-933a-ad88e251bb5d/
Parent samples :
814e073523aed94d4433e76ef0d0ecaa94224313fb4e54e6716b26e22f06e5ac
d930e3006b889c13cdebe9004c021ed18ebe31f1504ffce27f10277e439329e0
e5349a064403917e3f1c3aa1cb2f18e4a09477242eb9f7bee5a80c724b1a49ab
a11f84458eb6e2663905a5f98596fb495ae8b813cd28f3cda787377976168453
SH256 hash:
fcd9a285076c520c73421fa9b0456c06cdbb3c087481f167e6bd5b18555dc191
MD5 hash:
bc1c82571e046deac0795f832966fda6
SHA1 hash:
76a5bf8577374c9e61abc76f4ba88ee044580525
Link:
https://www.unpac.me/results/9148c001-3e19-4945-933a-ad88e251bb5d/
SH256 hash:
52f358d201e81d3a0391cedd3042e2f957555b77aa49559f7fb810bbb7673ba1
MD5 hash:
c785ddc46141af772c75101d17c46a41
SHA1 hash:
e248723b6f60cc7607980d07172b64c33b2b2f15
Link:
https://www.unpac.me/results/9148c001-3e19-4945-933a-ad88e251bb5d/
SH256 hash:
533444f4a2ac259ac9956887c185846c996b55125fb1eb967b9bad4b726c4d34
MD5 hash:
2162832183698ff825e74f506727273e
SHA1 hash:
b2fdec77360c0760d2eaf81f3141c002f6518f2d
Link:
https://www.unpac.me/results/9148c001-3e19-4945-933a-ad88e251bb5d/
SH256 hash:
66a89b7b82a654436de27488797d01bc94504f74aca673b3888328d91e8559e8
MD5 hash:
67782bb05e9dfd3064210871fac14389
SHA1 hash:
8d763451f532b2383461891d7f220a06d6ef1d8c
Link:
https://www.unpac.me/results/9148c001-3e19-4945-933a-ad88e251bb5d/
SH256 hash:
e6ecc640876e676a08ee2d1b9e8e06329930dea9c4319fe6502dc5a9c9e14d35
MD5 hash:
be0604a399ab6ba90dd0519e33bd32a8
SHA1 hash:
353f916d2674aa66fe0b06e0b70f42231de3b52d
Detections:
Remcos
Create hunting rule
win_remcos_auto
Create hunting rule
Remcos
Create hunting rule
win_remcos_auto
Create hunting rule
Remcos
Create hunting rule
win_remcos_auto
Create hunting rule
Remcos
Create hunting rule
win_remcos_auto
Create hunting rule
Remcos
Create hunting rule
win_remcos_auto
Create hunting rule
Link:
https://www.unpac.me/results/9148c001-3e19-4945-933a-ad88e251bb5d/
Parent samples :
814e073523aed94d4433e76ef0d0ecaa94224313fb4e54e6716b26e22f06e5ac
d930e3006b889c13cdebe9004c021ed18ebe31f1504ffce27f10277e439329e0
e5349a064403917e3f1c3aa1cb2f18e4a09477242eb9f7bee5a80c724b1a49ab
a11f84458eb6e2663905a5f98596fb495ae8b813cd28f3cda787377976168453
SH256 hash:
fcd9a285076c520c73421fa9b0456c06cdbb3c087481f167e6bd5b18555dc191
MD5 hash:
bc1c82571e046deac0795f832966fda6
SHA1 hash:
76a5bf8577374c9e61abc76f4ba88ee044580525
Link:
https://www.unpac.me/results/9148c001-3e19-4945-933a-ad88e251bb5d/
SH256 hash:
52f358d201e81d3a0391cedd3042e2f957555b77aa49559f7fb810bbb7673ba1
MD5 hash:
c785ddc46141af772c75101d17c46a41
SHA1 hash:
e248723b6f60cc7607980d07172b64c33b2b2f15
Link:
https://www.unpac.me/results/9148c001-3e19-4945-933a-ad88e251bb5d/
SH256 hash:
533444f4a2ac259ac9956887c185846c996b55125fb1eb967b9bad4b726c4d34
MD5 hash:
2162832183698ff825e74f506727273e
SHA1 hash:
b2fdec77360c0760d2eaf81f3141c002f6518f2d
Link:
https://www.unpac.me/results/9148c001-3e19-4945-933a-ad88e251bb5d/
SH256 hash:
66a89b7b82a654436de27488797d01bc94504f74aca673b3888328d91e8559e8
MD5 hash:
67782bb05e9dfd3064210871fac14389
SHA1 hash:
8d763451f532b2383461891d7f220a06d6ef1d8c
Link:
https://www.unpac.me/results/9148c001-3e19-4945-933a-ad88e251bb5d/
SH256 hash:
e6ecc640876e676a08ee2d1b9e8e06329930dea9c4319fe6502dc5a9c9e14d35
MD5 hash:
be0604a399ab6ba90dd0519e33bd32a8
SHA1 hash:
353f916d2674aa66fe0b06e0b70f42231de3b52d
Detections:
Remcos
Create hunting rule
win_remcos_auto
Create hunting rule
Remcos
Create hunting rule
win_remcos_auto
Create hunting rule
Remcos
Create hunting rule
win_remcos_auto
Create hunting rule
Remcos
Create hunting rule
win_remcos_auto
Create hunting rule
Remcos
Create hunting rule
win_remcos_auto
Create hunting rule
Link:
https://www.unpac.me/results/9148c001-3e19-4945-933a-ad88e251bb5d/
Parent samples :
814e073523aed94d4433e76ef0d0ecaa94224313fb4e54e6716b26e22f06e5ac
d930e3006b889c13cdebe9004c021ed18ebe31f1504ffce27f10277e439329e0
e5349a064403917e3f1c3aa1cb2f18e4a09477242eb9f7bee5a80c724b1a49ab
a11f84458eb6e2663905a5f98596fb495ae8b813cd28f3cda787377976168453
SH256 hash:
52f358d201e81d3a0391cedd3042e2f957555b77aa49559f7fb810bbb7673ba1
MD5 hash:
c785ddc46141af772c75101d17c46a41
SHA1 hash:
e248723b6f60cc7607980d07172b64c33b2b2f15
Link:
https://www.unpac.me/results/9148c001-3e19-4945-933a-ad88e251bb5d/
SH256 hash:
fcd9a285076c520c73421fa9b0456c06cdbb3c087481f167e6bd5b18555dc191
MD5 hash:
bc1c82571e046deac0795f832966fda6
SHA1 hash:
76a5bf8577374c9e61abc76f4ba88ee044580525
Link:
https://www.unpac.me/results/9148c001-3e19-4945-933a-ad88e251bb5d/
SH256 hash:
533444f4a2ac259ac9956887c185846c996b55125fb1eb967b9bad4b726c4d34
MD5 hash:
2162832183698ff825e74f506727273e
SHA1 hash:
b2fdec77360c0760d2eaf81f3141c002f6518f2d
Link:
https://www.unpac.me/results/9148c001-3e19-4945-933a-ad88e251bb5d/
SH256 hash:
66a89b7b82a654436de27488797d01bc94504f74aca673b3888328d91e8559e8
MD5 hash:
67782bb05e9dfd3064210871fac14389
SHA1 hash:
8d763451f532b2383461891d7f220a06d6ef1d8c
Link:
https://www.unpac.me/results/9148c001-3e19-4945-933a-ad88e251bb5d/
SH256 hash:
e6ecc640876e676a08ee2d1b9e8e06329930dea9c4319fe6502dc5a9c9e14d35
MD5 hash:
be0604a399ab6ba90dd0519e33bd32a8
SHA1 hash:
353f916d2674aa66fe0b06e0b70f42231de3b52d
Detections:
Remcos
Create hunting rule
win_remcos_auto
Create hunting rule
Remcos
Create hunting rule
win_remcos_auto
Create hunting rule
Remcos
Create hunting rule
win_remcos_auto
Create hunting rule
Remcos
Create hunting rule
win_remcos_auto
Create hunting rule
Remcos
Create hunting rule
win_remcos_auto
Create hunting rule
Link:
https://www.unpac.me/results/9148c001-3e19-4945-933a-ad88e251bb5d/
Parent samples :
814e073523aed94d4433e76ef0d0ecaa94224313fb4e54e6716b26e22f06e5ac
d930e3006b889c13cdebe9004c021ed18ebe31f1504ffce27f10277e439329e0
e5349a064403917e3f1c3aa1cb2f18e4a09477242eb9f7bee5a80c724b1a49ab
a11f84458eb6e2663905a5f98596fb495ae8b813cd28f3cda787377976168453
SH256 hash:
fcd9a285076c520c73421fa9b0456c06cdbb3c087481f167e6bd5b18555dc191
MD5 hash:
bc1c82571e046deac0795f832966fda6
SHA1 hash:
76a5bf8577374c9e61abc76f4ba88ee044580525
Link:
https://www.unpac.me/results/9148c001-3e19-4945-933a-ad88e251bb5d/
SH256 hash:
a11f84458eb6e2663905a5f98596fb495ae8b813cd28f3cda787377976168453
MD5 hash:
134e456fc68f2909d4131e4b90c01511
SHA1 hash:
e5c25d24aa59016d0ad7ff49835b5f3709c966d2
Link:
https://www.unpac.me/results/9148c001-3e19-4945-933a-ad88e251bb5d/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a11f84458eb6e2663905a5f98596fb495ae8b813cd28f3cda787377976168453

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/410447/

Comments