MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a657f9efe2f82abb3f5adbd90e9cce0cda71769e39f301c2bce8bb214daab809. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	a657f9efe2f82abb3f5adbd90e9cce0cda71769e39f301c2bce8bb214daab809
SHA3-384 hash:	20cf3dbb7415ed40509b7c4ccc7e1f26fb386baf5c6ccb94b54c5c8663246963097431671eaf9a4154ebada564c3e279
SHA1 hash:	0ec6924030bae6fc3e986b7132a81c882dfd053f
MD5 hash:	546c3feb60e349a2c00e35de128670ec
humanhash:	juliet-earth-florida-neptune
File name:	file
Download:	download sample
Signature	RemcosRAT Alert Create hunting rule
File size:	440'320 bytes
First seen:	2023-12-28 16:30:04 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	8a3b06a792183c402d038c6ccea86944 (5 x RemcosRAT)
ssdeep	6144:JCJBSkHyP4DivRrO+d3cyU6320ho4nbJAj0N91EU7ZUFbz68AO2LjXH7OcrR6B3:JCJB/RuFhU6ho0ej0N91HFAAL77OB3
Threatray	1'061 similar samples on MalwareBazaar
TLSH	T133949E12B492C032C17212740E29FB7599BCBC212936597B73EA5E5BBE741C1BB36363
TrID	32.2% (.EXE) Win64 Executable (generic) (10523/12/4) 20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 15.4% (.EXE) Win16 NE executable (generic) (5038/12/1) 13.7% (.EXE) Win32 Executable (generic) (4505/5/1) 6.2% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):
dhash icon	c4d48eaa8ad4d4f8 (1'000 x RemcosRAT, 1 x Worm.Ramnit, 1 x Vjw0rm)
Reporter	jstrosch
Tags:	exe RemcosRAT

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

308

Origin country :

US

Vendor Threat Intelligence

CAPE Sandbox Remcos

Detection:

Remcos

Alert

Create hunting rule

Link:

https://www.capesandbox.com/analysis/469527/

ClamAV Detected

Detection(s):

Win.Trojan.Remcos-9841897-0

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Сreating synchronization primitives

Creating a file

Creating a window

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

control fingerprint greyware lolbin remcos shell32

Link:

https://www.filescan.io/uploads/658da2c76b1c2460460d3006/reports/419679ad-161e-4604-a3f7-e060f6616373/overview

Hybrid Analysis DeepScan:Generic.Dacic.A9349469.A

Verdict:

Malicious

Labled as:

DeepScan:Generic.Dacic.A9349469.A

Link:

https://www.hybrid-analysis.com/sample/a657f9efe2f82abb3f5adbd90e9cce0cda71769e39f301c2bce8bb214daab809

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer REMCOS

Malware family:

REMCOS

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/b9caed7b-38c7-45a8-be9b-0e7efc74345a

Joe Sandbox Remcos

Result

Threat name:

Remcos

Alert

Create hunting rule

Detection:

malicious

Classification:

rans.troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1367733

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Contains functionality to modify clipboard data

Contains functionality to steal Chrome passwords or cookies

Contains functionality to steal Firefox passwords or cookies

Contains functionalty to change the wallpaper

Delayed program exit found

Found malware configuration

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Remcos RAT

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/a657f9efe2f82abb3f5adbd90e9cce0cda71769e39f301c2bce8bb214daab809

CERT.PL MWDB remcos

Detection:

remcos

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/a657f9efe2f82abb3f5adbd90e9cce0cda71769e39f301c2bce8bb214daab809/

ReversingLabs TitaniumCloud Win32.Backdoor.Remcos

Threat name:

Win32.Backdoor.Remcos

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-11-30 22:13:52 UTC

File Type:

PE (Exe)

Extracted files:

8

AV detection:

33 of 37 (89.19%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=uzl7t37c7avlwp223pmq5hgobtnhc5u6hhzqdqv45c5sctnkxaeq._file

Threatray remcos

Verdict:

malicious

Label(s):

remcos

Alert

Create hunting rule

Similar samples:

257060c9a55f064aca8aa6ff7003b80d72c9dd08b63922241ec468b05ed205c4

RemcosRAT

2efdfea9644c378bb7e04dac7b7a2b4760ef9a4925026a3a23d804efefd2f26a

RemcosRAT

6f6d7329e0948b935011c95d6f3899c917279086347ad85ddf4494ada1970ec6

RemcosRAT

a657f9efe2f82abb3f5adbd90e9cce0cda71769e39f301c2bce8bb214daab809

RemcosRAT

c3f58fc7e4e51a2d4c6551fd6cebac7d8c0bf79d83f1235e7570c2db574df0f6

RemcosRAT

c9e9f4d1945fc9cb9daf5b4a72032a00ba7040154e3fe44be5371fbb7da695ea

RemcosRAT

db9b54869c09234b1284f990515224d7f86d1571fca2c3349329404f24cd2da1

RemcosRAT

+ 1'051 additional samples on MalwareBazaar

Hatching Triage remcos

Result

Malware family:

remcos

Alert

Create hunting rule

Score:

  10/10

Tags:

family:remcos botnet:remotehost

Link:

https://tria.ge/reports/231228-tzv3tseeem/

Behaviour

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Malware Config

C2 Extraction:

127.0.0.1:1800

UnpacMe win_remcos_w0 win_remcos_auto malware_windows_remcos_rat

Unpacked files

SH256 hash:

a657f9efe2f82abb3f5adbd90e9cce0cda71769e39f301c2bce8bb214daab809

MD5 hash:

546c3feb60e349a2c00e35de128670ec

SHA1 hash:

0ec6924030bae6fc3e986b7132a81c882dfd053f

Detections:

win_remcos_w0

Alert

Create hunting rule

win_remcos_auto

Alert

Create hunting rule

malware_windows_remcos_rat

Alert

Create hunting rule

Link:

https://www.unpac.me/results/ec2adcd7-5162-43c5-b6bc-ba674c79361f/

VMRay Remcos

Malware family:

Remcos

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/a657f9efe2f8/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/a657f9efe2f82abb3f5adbd90e9cce0cda71769e39f301c2bce8bb214daab809

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RemcosRAT

exe a657f9efe2f82abb3f5adbd90e9cce0cda71769e39f301c2bce8bb214daab809

(this sample)

  

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/469527/