MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a598b3824495f56c447a88ccfdc805f077370ae2255a999cf00464da1d53d9a0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 12


Intelligence 12 IOCs 1 YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a598b3824495f56c447a88ccfdc805f077370ae2255a999cf00464da1d53d9a0
SHA3-384 hash: 60587db4c6afb7f9e56356e24a4fdec35eebe05b8fd7e7bb0b772437881e311b2d8632a20445ac566f3f67793c384f8d
SHA1 hash: 192846ce11bfd57d0c50c0e0e99e910ebf686519
MD5 hash: 39111af805c7028a00c60a7cb5852fdb
humanhash: fillet-robert-spring-louisiana
File name:DHL delivery confirmation of customer.pdf.exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'434'624 bytes
First seen:2022-03-16 18:21:06 UTC
Last seen:2022-03-16 19:55:25 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 24576:czE6wOMTLfE6hppM/jQqkpZX3HpnXWTN8OMl/NWex6Z9ZLH6pe1PB:cHfZ0rXHJnmC/bx6BpJ
Threatray 1'081 similar samples on MalwareBazaar
TLSH T1BC65121777AE8F03C6695A76D5CB050097B1EF962933CA4A3DE837EC4543743AA2818F
Reporter abuse_ch
Tags:exe RAT RemcosRAT


Avatar
abuse_ch
RemcosRAT C2:
62.197.136.163:2404

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
62.197.136.163:2404 https://threatfox.abuse.ch/ioc/395809/

Intelligence

File Origin
# of uploads :
2
# of downloads :
270
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
DHL delivery confirmation of customer.pdf.exe
Verdict:
Malicious activity
Analysis date:
2022-03-17 03:09:20 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/512264c4-eaf0-49fc-945a-26926c9efa4f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/251537/
Detection(s):
SecuriteInfo.com.PWSX-genTrj.555.28223.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Creating a window
Sending a custom TCP request
Launching a process
Creating a process with a hidden window
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
control.exe obfuscated packed replace.exe
Link:
https://www.filescan.io/uploads/62322ad0b94fb38cb490b500/reports/8e607179-f136-4750-bac3-5983cfb0a739/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
REMCOS
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/ff9252d4-2836-4133-9349-17ec2af8cb89
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/958234
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Delayed program exit found
Detected unpacking (creates a PE file in dynamic memory)
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Sigma detected: Suspect Svchost Activity
Sigma detected: Suspicious Add Scheduled Task From User AppData Temp
Sigma detected: Suspicious Double Extension
Sigma detected: Suspicious Svchost Process
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses an obfuscated file name to hide its real file extension (double extension)
Uses dynamic DNS services
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 590715 Sample: DHL delivery confirmation o... Startdate: 16/03/2022 Architecture: WINDOWS Score: 100 76 primetoolz.duckdns.org 2->76 78 part-0017.t-0009.fb-t-msedge.net 2->78 80 7 other IPs or domains 2->80 94 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->94 96 Found malware configuration 2->96 98 Malicious sample detected (through community Yara rule) 2->98 100 21 other signatures 2->100 10 DHL delivery confirmation of customer.pdf.exe 7 2->10         started        signatures3 process4 file5 70 C:\Users\user\AppData\...\BFilfJwvmUyW.exe, PE32 10->70 dropped 72 C:\Users\user\AppData\Local\...\tmp4C15.tmp, XML 10->72 dropped 74 DHL delivery confi...ustomer.pdf.exe.log, ASCII 10->74 dropped 102 Adds a directory exclusion to Windows Defender 10->102 104 Injects a PE file into a foreign processes 10->104 14 DHL delivery confirmation of customer.pdf.exe 3 3 10->14         started        18 powershell.exe 23 10->18         started        20 schtasks.exe 1 10->20         started        signatures6 process7 dnsIp8 92 primetoolz.duckdns.org 62.197.136.163, 2404, 49752, 50086 SPRINTLINKUS Netherlands 14->92 106 Writes to foreign memory regions 14->106 108 Allocates memory in foreign processes 14->108 110 Installs a global keyboard hook 14->110 112 Injects a PE file into a foreign processes 14->112 22 svchost.exe 12 14->22         started        24 svchost.exe 14->24         started        26 svchost.exe 14->26         started        32 5 other processes 14->32 28 conhost.exe 18->28         started        30 conhost.exe 20->30         started        signatures9 process10 process11 34 chrome.exe 22->34         started        37 chrome.exe 22->37         started        39 chrome.exe 24->39         started        41 chrome.exe 24->41         started        43 chrome.exe 26->43         started        45 chrome.exe 26->45         started        47 chrome.exe 32->47         started        49 chrome.exe 32->49         started        51 chrome.exe 32->51         started        dnsIp12 82 192.168.2.1 unknown unknown 34->82 84 239.255.255.250 unknown Reserved 34->84 53 chrome.exe 34->53         started        56 chrome.exe 37->56         started        58 chrome.exe 39->58         started        60 chrome.exe 41->60         started        62 chrome.exe 43->62         started        64 chrome.exe 45->64         started        66 chrome.exe 47->66         started        68 chrome.exe 49->68         started        process13 dnsIp14 86 mdec.nelreports.net 53->86 88 part-0032.t-0009.fb-t-msedge.net 13.107.253.60, 443, 49776, 49777 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 53->88 90 10 other IPs or domains 53->90
Detection:
remcos
Create hunting rule
Link:
https://mwdb.cert.pl/sample/a598b3824495f56c447a88ccfdc805f077370ae2255a999cf00464da1d53d9a0/
Threat name:
ByteCode-MSIL.Backdoor.Remcos
Create hunting rule
Status:
Malicious
First seen:
2022-03-16 18:22:14 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
16 of 41 (39.02%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=uwmlhasesx2wyrd2rdgp3saf6b3tocxcevnjthhqarsnuhkt3gqa._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
09b75cdc3edcad3cc8b1729683a1132506e851c9d7a1d864fc842284822d1ba5
RemcosRAT
3d80ce9c358e80b99744631236e2ed9b598d4cec9951f937f23b0d308da9487e
RemcosRAT
4d1cfc06d50c33a02572d8d32f34c277bb89bad8d2932c4e0549409d98d5ddda
RemcosRAT
6ea16cb1cf48e7eaec58a6f2aa22119b3753adff7782d5ce96282ba99e6ffa42
RemcosRAT
a439a0f9a25819c7b124965c1d48eff1f981aa3d6190c3f24239c97ec39b2c39
RemcosRAT
a5235adab75f69fd47b814a81ed89fe195e9a37e59c742e42363379742fc3b43
RemcosRAT
c530ab34e439bbcaf995290504072a5f77ec085e2ef485e4ef324b7a957f5738
RemcosRAT
d1ececa600d9b37a14dbdee36b5cd58a20932bf976cab21c461c42b96e79f196
RemcosRAT
f216501f3a4213b738c07cc290e3b5eceb2f35ea410b2ae1b1b188e27ebddc7d
RemcosRAT
fa7229938d7109be9b5947f67058cb3cab1d366ababae65b83786b80584a160a
RemcosRAT
+ 1'071 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:remotehost brand:microsoft phishing rat suricata
Link:
https://tria.ge/reports/220316-wzw18sdhal/
Behaviour
Creates scheduled task(s)
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Detected potential entity reuse from brand microsoft.
Suspicious use of SetThreadContext
Checks computer location settings
Remcos
suricata: ET MALWARE Remocs 3.x Unencrypted Checkin
suricata: ET MALWARE Remocs 3.x Unencrypted Server Response
Malware Config
C2 Extraction:
primetoolz.duckdns.org:2404
Unpacked files
SH256 hash:
acd192acf88227fe477f4d042448fa440d2b4208efafb13bc9dc82e692a07fa9
MD5 hash:
e7ae16495e634f46d475882e997a5ee3
SHA1 hash:
ee2d0676aabdce4921c88dc9bc5b8d558713f144
Link:
https://www.unpac.me/results/30df7522-36c0-41e1-8a37-34d44bc00f9c/
SH256 hash:
ae049d13f75dfde9aff1df620159b2f298cf141513360303e172f32517482aa3
MD5 hash:
e4221e20625c135e998fda478a2a9bad
SHA1 hash:
d1618e46191f9038c7246028215ae2d4ca063201
Link:
https://www.unpac.me/results/30df7522-36c0-41e1-8a37-34d44bc00f9c/
SH256 hash:
4ffb59b76867dc3ee5df8b1476a82043c8bbfa9679aa90a2e4b937292b3722b8
MD5 hash:
fc6d91ff314356715f5c76ba61240c9f
SHA1 hash:
aac8291f9af1c2e18b8302550ee4d1c96120949a
Link:
https://www.unpac.me/results/30df7522-36c0-41e1-8a37-34d44bc00f9c/
SH256 hash:
e3f773aeecd0175f8fced3179dc01ef341fddf2ee8479eb465edb76280a63e63
MD5 hash:
0f596946a2d351be7d8ed68d98fac665
SHA1 hash:
3353fb60d79c99553003418fef82e1ee811a226a
Link:
https://www.unpac.me/results/30df7522-36c0-41e1-8a37-34d44bc00f9c/
SH256 hash:
a598b3824495f56c447a88ccfdc805f077370ae2255a999cf00464da1d53d9a0
MD5 hash:
39111af805c7028a00c60a7cb5852fdb
SHA1 hash:
192846ce11bfd57d0c50c0e0e99e910ebf686519
Link:
https://www.unpac.me/results/30df7522-36c0-41e1-8a37-34d44bc00f9c/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a598b3824495f56c447a88ccfdc805f077370ae2255a999cf00464da1d53d9a0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/251537/

Comments