MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a767b580fa20f007fcac6ef48b4fc9e7397a47c00feed0334ecfb6d118f2da9c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 17


Intelligence 17 IOCs YARA 18 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a767b580fa20f007fcac6ef48b4fc9e7397a47c00feed0334ecfb6d118f2da9c
SHA3-384 hash: bcff7e4c2ef26ff4b1ffc837460db28761df33110447c0e16b92e99394de98486cd9c37f3d8bfb1dc24cb01647f95397
SHA1 hash: 41daaaae5e15cb3480f43fb62f0d674dd51404a7
MD5 hash: 288554293c54d5da83a2110619d996a5
humanhash: table-cardinal-single-florida
File name:288554293c54d5da83a2110619d996a5
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:2'109'952 bytes
First seen:2023-04-05 00:33:21 UTC
Last seen:2023-04-05 12:58:30 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'608 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 24576:nj/JOSfbOOZQTRU4CNVpSaPfj5cHmC0U3E3Eqvv6F9J6CIDtGyXXY4vkhg00BZtf:luGQTG4kVkya30UUwkVnDkhgjVU
Threatray 1'821 similar samples on MalwareBazaar
TLSH T142A5D0B25AC9FE96DFE57A70FC2111880CA8ACFB6398DA59B48C54CF0D64A14DC46DF0
TrID 63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.2% (.SCR) Windows screen saver (13097/50/3)
9.0% (.EXE) Win64 Executable (generic) (10523/12/4)
5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.8% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter Anonymous
Tags:exe RemcosRAT

Intelligence

File Origin
# of uploads :
2
# of downloads :
397
Origin country :
KR KR
Vendor Threat Intelligence
Malware family:
remcos
Create hunting rule
ID:
1
File name:
288554293c54d5da83a2110619d996a5
Verdict:
Malicious activity
Analysis date:
2023-04-05 00:36:15 UTC
Tags:
rat remcos
Link:
https://app.any.run/tasks/65e1f0ab-aaf1-45f4-b5be-4cfb2510eb2b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Remcos
Create hunting rule
Link:
https://www.capesandbox.com/analysis/380144/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.66237791.20720.26308.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Launching a process
Creating a process with a hidden window
Sending an HTTP GET request
Creating a file in the %AppData% subdirectories
Unauthorized injection to a recently created process
Creating a file
Setting a keyboard event handler
DNS request
Sending a custom TCP request
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/642cc1fb497fb6f23efd6c78/reports/649ac70c-b60e-4961-949c-75760356aff3/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/a767b580fa20f007fcac6ef48b4fc9e7397a47c00feed0334ecfb6d118f2da9c
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
REMCOS
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/2642494d-f77d-4031-97b0-470c6a9290ca
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1208490
Signature
.NET source code contains potential unpacker
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to bypass UAC (CMSTPLUA)
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Delayed program exit found
Encrypted powershell cmdline option found
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Remcos
Uses dynamic DNS services
Yara detected Generic Downloader
Yara detected Remcos RAT
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 841406 Sample: b49GWr99um.exe Startdate: 05/04/2023 Architecture: WINDOWS Score: 100 52 Malicious sample detected (through community Yara rule) 2->52 54 Antivirus detection for URL or domain 2->54 56 Multi AV Scanner detection for dropped file 2->56 58 15 other signatures 2->58 7 b49GWr99um.exe 1 5 2->7         started        11 winrar.exe 1 2->11         started        13 winrar.exe 2 2->13         started        process3 file4 40 C:\Users\user\AppData\Roaming\...\winrar.exe, PE32 7->40 dropped 42 C:\Users\user\...\winrar.exe:Zone.Identifier, ASCII 7->42 dropped 44 C:\Users\user\AppData\...\b49GWr99um.exe.log, ASCII 7->44 dropped 60 Encrypted powershell cmdline option found 7->60 62 Injects a PE file into a foreign processes 7->62 15 b49GWr99um.exe 2 17 7->15         started        20 powershell.exe 15 7->20         started        22 powershell.exe 15 11->22         started        24 winrar.exe 11->24         started        26 winrar.exe 11->26         started        28 powershell.exe 15 13->28         started        30 winrar.exe 13->30         started        signatures5 process6 dnsIp7 46 forwarding2023.ddns.net 185.225.73.58, 18114, 49700 MAYAKBG Germany 15->46 48 geoplugin.net 178.237.33.50, 49701, 80 ATOM86-ASATOM86NL Netherlands 15->48 38 C:\ProgramData\remcos\logs.dat, data 15->38 dropped 50 Installs a global keyboard hook 15->50 32 conhost.exe 20->32         started        34 conhost.exe 22->34         started        36 conhost.exe 28->36         started        file8 signatures9 process10
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a767b580fa20f007fcac6ef48b4fc9e7397a47c00feed0334ecfb6d118f2da9c/
Threat name:
Win32.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2023-04-05 00:34:10 UTC
File Type:
PE (.Net Exe)
Extracted files:
37
AV detection:
20 of 24 (83.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=u5t3lah2edyap7fmn32iwt6j444xur6ab7xnam2oz63ncghs3koa._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
02ced6da9cf24901681948deae308d36975cb623dcc6735f2142f4252bc7e197
RemcosRAT
0c10e1c8152eb2a30a9270ef79401b905e42bb6706d71094b59dd46502336f8e
RemcosRAT
16a1100ab0af5497ee45778f1a516357b3bae96797c9417d2e028a31ebe2bf80
RemcosRAT
1d0a51787f8726c44aa40f88422d01f084c4e533c2f190f4aef1696f9fd600d9
RemcosRAT
4bfea5eeb97d0ca4f3f2edd8114048e9a14f43f89187c55f29f2142cdef8da9a
RemcosRAT
c3653e6517e48603a356a5978cdc1b210bd20e023146fd561c611c3b82c0736c
RemcosRAT
c3f43d2f1e2f99cf22384cf00cfde5edadebd79e5d60bbaffee2cd5431fc0fab
RemcosRAT
+ 1'811 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:remotehost ky persistence rat
Link:
https://tria.ge/reports/230405-awr28aah55/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Checks computer location settings
Remcos
Malware Config
C2 Extraction:
forwarding2023.ddns.net:18114
Unpacked files
SH256 hash:
ff8c24bce1eb009f0d5c47a09b96caf02726c285cea0d635082ad4da27e63d1b
MD5 hash:
9d6ec6072ee1814a4a01d1eb3fb67ba1
SHA1 hash:
d0b416de1c900b6bcb35dc182b2e8744f16c3289
Link:
https://www.unpac.me/results/9e038ee6-1ae0-4283-a9af-8132f8afa760/
SH256 hash:
cf5a6961ca9a88998303116e6be17b86be54adf293eab7bbb852bd5c728738ad
MD5 hash:
376266d68b6b13f9265f8d6440c59357
SHA1 hash:
b955586105b85a61b0e4385353b10fd5811e85ce
Detections:
Remcos
Create hunting rule
win_remcos_auto
Create hunting rule
Link:
https://www.unpac.me/results/9e038ee6-1ae0-4283-a9af-8132f8afa760/
SH256 hash:
81cb0b4f6cbb482c40224603a10b15f3c4b7f9b2d6f6cdbc1dfaa1df615612c7
MD5 hash:
fd7e77945290bf5f5b692600182e60c5
SHA1 hash:
98d5adc2fe39831767329ba7ebef7097685d8365
Link:
https://www.unpac.me/results/9e038ee6-1ae0-4283-a9af-8132f8afa760/
SH256 hash:
96325843314f89fc72f6b64f916cb0686d9c074dd034ff135a3173f7f373327f
MD5 hash:
253a936c4c1fe2e75c7b59194be669e2
SHA1 hash:
4217ca0cae0103136faff78de7dda4bb72cb200c
Link:
https://www.unpac.me/results/9e038ee6-1ae0-4283-a9af-8132f8afa760/
SH256 hash:
52cc96904b8ac8a3275b6465e4aa5f822259948e004c5d75cfacff210eedc36a
MD5 hash:
afd791821c9425e890d5684205d9e3d0
SHA1 hash:
2f41a232b8abdeccfa9a192d1d776f8743bbfd95
Link:
https://www.unpac.me/results/9e038ee6-1ae0-4283-a9af-8132f8afa760/
SH256 hash:
a767b580fa20f007fcac6ef48b4fc9e7397a47c00feed0334ecfb6d118f2da9c
MD5 hash:
288554293c54d5da83a2110619d996a5
SHA1 hash:
41daaaae5e15cb3480f43fb62f0d674dd51404a7
Link:
https://www.unpac.me/results/9e038ee6-1ae0-4283-a9af-8132f8afa760/
Malware family:
Remcos
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/a767b580fa20/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a767b580fa20f007fcac6ef48b4fc9e7397a47c00feed0334ecfb6d118f2da9c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:iexplorer_remcos
Create hunting rule
Author:iam-py-test
Description:Detect iexplorer being taken over by Remcos
Rule name:INDICATOR_EXE_Packed_MPress
Create hunting rule
Author:ditekSHen
Description:Detects executables built or packed with MPress PE compressor
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
Create hunting rule
Author:ditekSHen
Description:Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:pe_imphash
Create hunting rule
Rule name:QbotStuff
Create hunting rule
Author:anonymous
Rule name:Remcos
Create hunting rule
Author:kevoreilly
Description:Remcos Payload
Rule name:REMCOS_RAT_variants
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Suspicious_Macro_Presence
Create hunting rule
Author:Mehmet Ali Kerimoglu (CYB3RMX)
Description:This rule detects common malicious/suspicious implementations.
Rule name:TeslaCryptPackedMalware
Create hunting rule
Rule name:Windows_Trojan_Remcos_b296e965
Create hunting rule
Author:Elastic Security
Rule name:win_remcos_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.remcos.
Rule name:yara_template
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/380144/

Comments