MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a5235adab75f69fd47b814a81ed89fe195e9a37e59c742e42363379742fc3b43. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 13


Intelligence 13 IOCs 1 YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a5235adab75f69fd47b814a81ed89fe195e9a37e59c742e42363379742fc3b43
SHA3-384 hash: f293f3f5ef81b08160dab451f3bbc9e3a89694d2a607d92435201120c28c7dfbe6c16f28ba9c53f1b3bf0cfd5f5a25e4
SHA1 hash: d9caa0a23ac4cdc0afdf7bd4984ed717a3e5aba1
MD5 hash: e89a1afe7fadecf23594df4cc84cbb1d
humanhash: lion-xray-network-chicken
File name:e89a1afe7fadecf23594df4cc84cbb1d.exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'341'552 bytes
First seen:2022-03-13 13:15:26 UTC
Last seen:2022-03-13 14:38:06 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 24576:KCSSfzWXagfSvzGCWAZ2dmHVX1X3NpoOiSrOxe6BcDhW7OYRNHn0:KCgXaUSqCadmHdt3N3N/lW7OYc
Threatray 2'793 similar samples on MalwareBazaar
TLSH T1EC55CF1099551836E17A7A7B17C4A8234AE7AE66351CE2BE1C3CF6490FF2E7D8C80C75
File icon (PE):PE icon
dhash icon 000f272b0b270e00 (2 x RemcosRAT)
Reporter abuse_ch
Tags:exe RAT RemcosRAT


Avatar
abuse_ch
RemcosRAT C2:
194.31.98.93:22301

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
194.31.98.93:22301 https://threatfox.abuse.ch/ioc/394938/

Intelligence

File Origin
# of uploads :
2
# of downloads :
270
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/249871/
Detection(s):
SecuriteInfo.com.Trojan.Inject4.27826.15991.13788.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Сreating synchronization primitives
Launching a process
Creating a process with a hidden window
Launching cmd.exe command interpreter
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
obfuscated overlay packed replace.exe
Link:
https://www.filescan.io/uploads/622dee960cd58dbd928e6b3a/reports/26d6632f-7115-4fb8-8079-c2e1cde0fd72/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
REMCOS
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/76ce2f15-3625-41b9-bef9-a7f34cc06b5c
Result
Threat name:
Nanocore Remcos
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/955578
Signature
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Connects to many ports of the same IP (likely port scanning)
Contains functionality to inject code into remote processes
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Delayed program exit found
Detected Nanocore Rat
Detected unpacking (creates a PE file in dynamic memory)
Detected unpacking (overwrites its own PE header)
Disables UAC (registry)
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: NanoCore
Sigma detected: Suspect Svchost Activity
Sigma detected: Suspicious Add Scheduled Task From User AppData Temp
Sigma detected: Suspicious Svchost Process
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to steal Instant Messenger accounts or passwords
Uses dynamic DNS services
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM3
Yara detected Nanocore RAT
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 588059 Sample: SaXu3fKoNG.exe Startdate: 13/03/2022 Architecture: WINDOWS Score: 100 69 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->69 71 Found malware configuration 2->71 73 Malicious sample detected (through community Yara rule) 2->73 75 19 other signatures 2->75 8 SaXu3fKoNG.exe 7 2->8         started        12 dhcpmon.exe 2->12         started        process3 file4 45 C:\Users\user\AppData\...\wlRVILlzVk.exe, PE32 8->45 dropped 47 C:\Users\...\wlRVILlzVk.exe:Zone.Identifier, ASCII 8->47 dropped 49 C:\Users\user\AppData\Local\...\tmp1B74.tmp, XML 8->49 dropped 51 C:\Users\user\AppData\...\SaXu3fKoNG.exe.log, ASCII 8->51 dropped 79 Detected unpacking (creates a PE file in dynamic memory) 8->79 81 Contains functionality to steal Chrome passwords or cookies 8->81 83 Contains functionality to inject code into remote processes 8->83 85 5 other signatures 8->85 14 SaXu3fKoNG.exe 3 15 8->14         started        19 powershell.exe 25 8->19         started        21 schtasks.exe 1 8->21         started        23 SaXu3fKoNG.exe 8->23         started        signatures5 process6 dnsIp7 63 transfer.sh 144.76.136.153, 443, 49776 HETZNER-ASDE Germany 14->63 65 305way.duckdns.org 194.31.98.93, 22301, 22306, 49768 BURSABILTR Netherlands 14->65 57 C:\Users\user\AppData\Roaming\dwn.exe, PE32 14->57 dropped 59 C:\Users\user\AppData\Local\...\nano[1].exe, PE32 14->59 dropped 67 Injects a PE file into a foreign processes 14->67 25 dwn.exe 14->25         started        30 cmd.exe 1 14->30         started        32 SaXu3fKoNG.exe 1 14->32         started        38 3 other processes 14->38 34 conhost.exe 19->34         started        36 conhost.exe 21->36         started        file8 signatures9 process10 dnsIp11 61 305way.duckdns.org 25->61 53 C:\Program Files\DHCP Monitor\dhcpmon.exe, PE32 25->53 dropped 55 C:\Users\user\AppData\Roaming\...\run.dat, data 25->55 dropped 87 Antivirus detection for dropped file 25->87 89 Detected unpacking (overwrites its own PE header) 25->89 91 Machine Learning detection for dropped file 25->91 93 Hides that the sample has been downloaded from the Internet (zone.identifier) 25->93 40 reg.exe 1 30->40         started        43 conhost.exe 30->43         started        95 Tries to steal Instant Messenger accounts or passwords 32->95 file12 signatures13 process14 signatures15 77 Disables UAC (registry) 40->77
Detection:
remcos
Create hunting rule
Link:
https://mwdb.cert.pl/sample/a5235adab75f69fd47b814a81ed89fe195e9a37e59c742e42363379742fc3b43/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-03-11 15:43:00 UTC
File Type:
PE (.Net Exe)
Extracted files:
16
AV detection:
29 of 42 (69.05%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=uurvvwvxl5u72r5ycsub5we74gk6ti36lhdufzbdmm3zoqx4hnbq._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
361ea662d75ba904bd3f0fbba782ef03eeab294f6dd736b79090fcfc2dd25166
RemcosRAT
88a52cb96bc7ae6d6788e1c3f4bca7c4bd379037cba08c6a86f28694f767d9d9
RemcosRAT
b2b62a37a18c2eeaffe26fb8f15af6964efa41f0bcdda7550a03c58a02653b3e
RemcosRAT
bd250e1cb4f8d322a5464549dc067ac7bcbecfc2d4fca46c40af8d23173011d3
RemcosRAT
cc93c7587dba9e4af2265a77a349230cb8ab0a0d8c524f4cfad4886fad7a34ab
RemcosRAT
d1000588f8a0fb8debc8ca3133fcbc32806b9dc5d7844157f171790cf5d86946
RemcosRAT
ec8915aa703260e0b1f1aa7d221c89cf5da6a330b0944d8f32e4159020617edb
RemcosRAT
ee34f06a904be05303304e7d9c018c7e12efb83cb9b93544c00a0385da5d1716
RemcosRAT
+ 2'783 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:nanocore family:remcos botnet:newbot brand:microsoft evasion keylogger phishing rat spyware stealer suricata trojan
Link:
https://tria.ge/reports/220313-qhta5ahdhn/
Behaviour
Creates scheduled task(s)
Modifies Internet Explorer settings
Modifies registry key
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Detected potential entity reuse from brand microsoft.
Suspicious use of SetThreadContext
Checks computer location settings
Reads user/profile data of web browsers
Downloads MZ/PE file
Executes dropped EXE
NirSoft WebBrowserPassView
Nirsoft
NanoCore
Remcos
UAC bypass
suricata: ET MALWARE Remocs 3.x Unencrypted Checkin
suricata: ET MALWARE Remocs 3.x Unencrypted Server Response
Malware Config
C2 Extraction:
305way.duckdns.org:22301
305way.duckdns.org:22302
305way.duckdns.org:22303
305way.duckdns.org:22304
305way.duckdns.org:22305
305way.duckdns.org:22306
127.0.0.1:22306
Unpacked files
SH256 hash:
a7d839b1e63abea8f631e3a219f584422527c4527125b8b532edcbeab45d390e
MD5 hash:
34662e3df497137549dc9e67ebe0e58b
SHA1 hash:
c5158f1231dee388d25b542fdadf94f6ebc2a1e3
Link:
https://www.unpac.me/results/93ae9a9e-ba4e-4996-bc75-acb35de54fa0/
SH256 hash:
175285bfa8a73b3990f54994b8825c1f3396635bc344939cd8d9fc60b9569b46
MD5 hash:
f26eb90c6addfc99fa0c2e63896216d2
SHA1 hash:
77e01b96d8c211d4d24fc0a1aae91122caf5f668
Link:
https://www.unpac.me/results/93ae9a9e-ba4e-4996-bc75-acb35de54fa0/
SH256 hash:
aba894ef5fdb158f818fab75b66c97463bcec6eb6d66a55abf17196ab82b05c4
MD5 hash:
519f706a7926561eba0f75b68fef8660
SHA1 hash:
5a29a45113f04733540d6dd80731751b533bc6ca
Link:
https://www.unpac.me/results/93ae9a9e-ba4e-4996-bc75-acb35de54fa0/
SH256 hash:
0ec9f782d4aa877929a3eda53d5054e79eaf5f3dd89d52efa2f9b365f036e488
MD5 hash:
835a100ffd6767fb5f5463b66f1955a7
SHA1 hash:
3b4c79a15b452715b6c10d9c662957183e16cb3f
Link:
https://www.unpac.me/results/93ae9a9e-ba4e-4996-bc75-acb35de54fa0/
SH256 hash:
a5235adab75f69fd47b814a81ed89fe195e9a37e59c742e42363379742fc3b43
MD5 hash:
e89a1afe7fadecf23594df4cc84cbb1d
SHA1 hash:
d9caa0a23ac4cdc0afdf7bd4984ed717a3e5aba1
Link:
https://www.unpac.me/results/93ae9a9e-ba4e-4996-bc75-acb35de54fa0/
Malware family:
Remcos
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/a5235adab75f/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a5235adab75f69fd47b814a81ed89fe195e9a37e59c742e42363379742fc3b43

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/249871/

Comments