MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a739f75be90696d11429b7b5003af6ae0318009bdabdecdcd49b18d80c60d946. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	a739f75be90696d11429b7b5003af6ae0318009bdabdecdcd49b18d80c60d946
SHA3-384 hash:	39f5c476147e47114ec37c2145fa039e7853d7bd2506abca2b855b990616e12baf4df2d9274b6d26905ed273c1b5ceb9
SHA1 hash:	5e32eb53c8ff82ef5dfe9fa41158af2c131998e4
MD5 hash:	2ba2baa0a9f2917074f70a50f10ddee9
humanhash:	nevada-high-sweet-london
File name:	a739f75be90696d11429b7b5003af6ae0318009bdabdecdcd49b18d80c60d946
Download:	download sample
Signature	RemcosRAT Alert Create hunting rule
File size:	494'080 bytes
First seen:	2023-12-18 08:51:04 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	8d5087ff5de35c3fbb9f212b47d63cad (170 x RemcosRAT)
ssdeep	6144:yXIktXfM8Lv86r9uVWAa2je4Z5zl4hgDHQQs4NTQjoHFsAOZZsAX4cN35Gv:yX7tPMK8ctGe4Dzl4h2QnuPs/ZsScv
TLSH	T1F7B49E01BAD1C072D57514300D3AF776EAB8BD2028364A7BB3D61D5BFE31190B62A6B7
TrID	32.2% (.EXE) Win64 Executable (generic) (10523/12/4) 20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 15.4% (.EXE) Win16 NE executable (generic) (5038/12/1) 13.7% (.EXE) Win32 Executable (generic) (4505/5/1) 6.2% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):
dhash icon	c4d48eaa8ad4d4f8 (1'000 x RemcosRAT, 1 x Worm.Ramnit, 1 x Vjw0rm)
Reporter	adrian__luca
Tags:	exe RemcosRAT

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

316

Origin country :

HU

Vendor Threat Intelligence

CAPE Sandbox Remcos

Detection:

Remcos

Alert

Create hunting rule

Link:

https://www.capesandbox.com/analysis/468254/

ClamAV Detected

Detection(s):

Win.Trojan.Remcos-9841897-0

Alert

Create hunting rule

Win.Trojan.Remcos-10002580-0

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Setting a keyboard event handler

Sending a custom TCP request

DNS request

Sending an HTTP GET request

Unauthorized injection to a recently created process

Restart of the analyzed sample

Creating a file

Reading critical registry keys

Creating a file in the %temp% directory

Stealing user critical data

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

control evasive exploit explorer fingerprint greyware hook keylogger lolbin shell32

Link:

https://www.filescan.io/uploads/65800834b2e45ed099bfbfe1/reports/2b6aa565-e83e-4279-ab0c-396ea1443b2e/overview

Hybrid Analysis Remcos.Generic

Verdict:

Malicious

Labled as:

Remcos.Generic

Link:

https://www.hybrid-analysis.com/sample/a739f75be90696d11429b7b5003af6ae0318009bdabdecdcd49b18d80c60d946

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer REMCOS

Malware family:

REMCOS

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/ffd347f8-be03-4fe8-b8b0-1e1adb5a0c39

Joe Sandbox Remcos

Result

Threat name:

Remcos

Alert

Create hunting rule

Detection:

malicious

Classification:

rans.troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1363824

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Contains functionality to bypass UAC (CMSTPLUA)

Contains functionality to inject code into remote processes

Contains functionality to modify clipboard data

Contains functionality to register a low level keyboard hook

Contains functionality to steal Chrome passwords or cookies

Contains functionality to steal Firefox passwords or cookies

Contains functionalty to change the wallpaper

Delayed program exit found

Found malware configuration

Installs a global keyboard hook

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Sigma detected: Remcos

Snort IDS alert for network traffic

Tries to steal Mail credentials (via file registry)

Writes to foreign memory regions

Yara detected Remcos RAT

Yara detected UAC Bypass using CMSTP

Yara detected WebBrowserPassView password recovery tool

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/a739f75be90696d11429b7b5003af6ae0318009bdabdecdcd49b18d80c60d946

CERT.PL MWDB remcos

Detection:

remcos

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/a739f75be90696d11429b7b5003af6ae0318009bdabdecdcd49b18d80c60d946/

ReversingLabs TitaniumCloud Win32.Backdoor.Remcos

Threat name:

Win32.Backdoor.Remcos

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-12-18 08:52:04 UTC

File Type:

PE (Exe)

Extracted files:

8

AV detection:

22 of 23 (95.65%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=u447ow7ja2lncfbjw62qaoxwvybrqae33k66zxgutmmnqdda3fda._file

Threatray remcos

Verdict:

malicious

Label(s):

remcos

Alert

Create hunting rule

Hatching Triage remcos

Result

Malware family:

remcos

Alert

Create hunting rule

Score:

  10/10

Tags:

family:remcos botnet:dollar collection rat

Link:

https://tria.ge/reports/231218-ksp4kahffp/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Accesses Microsoft Outlook accounts

NirSoft MailPassView

NirSoft WebBrowserPassView

Nirsoft

Remcos

Malware Config

C2 Extraction:

107.175.229.139:8087

UnpacMe Remcos win_remcos_w0 win_remcos_auto malware_windows_remcos_rat INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM win_remcos_rat_unpacked

Unpacked files

SH256 hash:

a739f75be90696d11429b7b5003af6ae0318009bdabdecdcd49b18d80c60d946

MD5 hash:

2ba2baa0a9f2917074f70a50f10ddee9

SHA1 hash:

5e32eb53c8ff82ef5dfe9fa41158af2c131998e4

Detections:

Remcos

Alert

Create hunting rule

win_remcos_w0

Alert

Create hunting rule

win_remcos_auto

Alert

Create hunting rule

malware_windows_remcos_rat

Alert

Create hunting rule

INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM

Alert

Create hunting rule

win_remcos_rat_unpacked

Alert

Create hunting rule

Link:

https://www.unpac.me/results/42e03718-3468-45d3-ad4a-590e1067027f/

Parent samples :

a739f75be90696d11429b7b5003af6ae0318009bdabdecdcd49b18d80c60d946
85e1ad6c1503ecfec6e03b38c24b93ce7c92a08f3c84f43db8946359054938c6
1862317879e1cfcaff8a4c2355f8d88b0911a4c848773f54bcb82c48f20480e6
62bfc227410b8cc5e8a3f6b6a7344e9ce2a91481278c7d0d2afae8ea3eb095ce
7cfbfe371912b59dec9a22cb39790c9f94774124ac786b48d493ec46830a0c1c
f72233b9518367bd3858ba7a54c631dfcb7090b3e8dac552ca4e7928cc9ea68a
be58907253b68299ffaa7d7bb9104e1faa2671ddd6e18f4b53261537895c87e8
449ecf2471ec8a48d115b252928053edc56f2bbf622a88db78274bdf3cc574ac

VMRay Remcos

Malware family:

Remcos

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/a739f75be906/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Remcos

Threat name:

Remcos

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/a739f75be90696d11429b7b5003af6ae0318009bdabdecdcd49b18d80c60d946

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

exe a739f75be90696d11429b7b5003af6ae0318009bdabdecdcd49b18d80c60d946

(this sample)

  

Delivery method

Distributed via e-mail attachment

Cape

https://www.capesandbox.com/analysis/468254/