MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 abde95665f00d689ae82d87023f15c909e8648e5d320b7fe680cdf910ec489ad. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 12


Intelligence 12 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: abde95665f00d689ae82d87023f15c909e8648e5d320b7fe680cdf910ec489ad
SHA3-384 hash: 408f9df98ac5117e53e30badb00d16d1cc844351db2af9df3810786d66f425399420a180715341b5582d2337156a1f76
SHA1 hash: 0857ec6ee9d27042117d30a86f968ef6864d6e42
MD5 hash: 046804d6a8900b2fff9596823db0ce93
humanhash: massachusetts-nevada-avocado-shade
File name:046804d6a8900b2fff9596823db0ce93.exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:3'003'408 bytes
First seen:2022-05-25 08:17:59 UTC
Last seen:2022-05-25 08:52:14 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 01d1b984e99e67b6f7ae46199d7dfd92 (12 x RemcosRAT)
ssdeep 49152:9hgfaw6+fnvkWEp/z0IKbj4nJegtcpuyAtX2ZWLT/XMEWKBK1MJ5FdLOJegTZkyW:9hgfXrfnwYJboJntX2ZQLXMEP1OJeg6b
Threatray 11'963 similar samples on MalwareBazaar
TLSH T197D5331709A606BFC8C442B5891BFD7008EA1F2C9306FA2D11EF7FD774A619CE396858
TrID 32.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
28.9% (.EXE) Win32 Executable (generic) (4505/5/1)
13.0% (.EXE) OS/2 Executable (generic) (2029/13)
12.8% (.EXE) Generic Win/DOS Executable (2002/3)
12.8% (.EXE) DOS Executable Generic (2000/1)
File icon (PE):PE icon
dhash icon c4d48eaa8ad4d4f8 (1'000 x RemcosRAT, 1 x Worm.Ramnit, 1 x Vjw0rm)
Reporter abuse_ch
Tags:exe RAT RemcosRAT

Intelligence

File Origin
# of uploads :
2
# of downloads :
303
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
remcos
Create hunting rule
ID:
1
File name:
046804d6a8900b2fff9596823db0ce93.exe
Verdict:
Malicious activity
Analysis date:
2022-05-25 09:56:48 UTC
Tags:
rat remcos stealer
Link:
https://app.any.run/tasks/c0ac32e0-ff5b-492f-ae4d-d57fbb95ac63

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Remcos
Create hunting rule
Link:
https://www.capesandbox.com/analysis/274420/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Searching for analyzing tools
Сreating synchronization primitives
Launching cmd.exe command interpreter
Creating a file in the %AppData% subdirectories
Creating a file in the %temp% directory
Launching a process
Changing a file
Creating a file
Creating a process from a recently created file
Creating a process with a hidden window
Creating a window
Running batch commands
Sending a custom TCP request
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Blocking the User Account Control
Forced shutdown of a system process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed shell32.dll
Link:
https://www.filescan.io/uploads/628de655abd1252350819358/reports/a6dd1165-913c-4578-be50-cef45a896b39/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/086fc332-5a93-43cd-b01c-f6766db86cd9
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1001373
Signature
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Contains functionality to inject code into remote processes
Hides threads from debuggers
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Query firmware table information (likely to detect VMs)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file / registry access)
Uses cmd line tools excessively to alter registry or file data
Writes to foreign memory regions
Yara detected Remcos RAT
Yara detected WebBrowserPassView password recovery tool
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 633869 Sample: EypCxcPevv.exe Startdate: 25/05/2022 Architecture: WINDOWS Score: 100 46 Antivirus detection for dropped file 2->46 48 Antivirus / Scanner detection for submitted sample 2->48 50 Multi AV Scanner detection for submitted file 2->50 52 4 other signatures 2->52 7 itunes.exe 3 1 2->7         started        11 EypCxcPevv.exe 4 5 2->11         started        process3 dnsIp4 42 185.29.9.125, 2404, 49771, 49772 DATACLUB-SE European Union 7->42 54 Antivirus detection for dropped file 7->54 56 Multi AV Scanner detection for dropped file 7->56 58 Query firmware table information (likely to detect VMs) 7->58 64 5 other signatures 7->64 14 svchost.exe 7->14         started        17 itunes.exe 1 7->17         started        19 cmd.exe 7->19         started        25 2 other processes 7->25 36 C:\Users\user\AppData\Roaming\...\itunes.exe, PE32 11->36 dropped 38 C:\Users\user\...\itunes.exe:Zone.Identifier, ASCII 11->38 dropped 40 C:\Users\user\AppData\Local\...\install.vbs, data 11->40 dropped 60 Hides threads from debuggers 11->60 62 Tries to detect sandboxes / dynamic malware analysis system (registry check) 11->62 21 cmd.exe 1 11->21         started        23 wscript.exe 11->23         started        file5 signatures6 process7 dnsIp8 66 Query firmware table information (likely to detect VMs) 14->66 68 Tries to detect sandboxes and other dynamic analysis tools (window names) 14->68 70 Hides threads from debuggers 14->70 72 Tries to detect sandboxes / dynamic malware analysis system (registry check) 14->72 74 Tries to steal Instant Messenger accounts or passwords 17->74 76 Tries to steal Mail credentials (via file / registry access) 17->76 28 conhost.exe 19->28         started        30 reg.exe 1 19->30         started        78 Uses cmd line tools excessively to alter registry or file data 21->78 32 conhost.exe 21->32         started        34 reg.exe 1 21->34         started        44 192.168.2.1 unknown unknown 25->44 80 Tries to harvest and steal browser information (history, passwords, etc) 25->80 signatures9 process10
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/abde95665f00d689ae82d87023f15c909e8648e5d320b7fe680cdf910ec489ad/
Threat name:
Win32.Trojan.Tiggre
Create hunting rule
Status:
Malicious
First seen:
2022-05-25 00:48:04 UTC
File Type:
PE (Exe)
Extracted files:
8
AV detection:
29 of 41 (70.73%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
1fed413e1cf6bf9886f077ac4ebe4c86b566917bf3b0cd806805acbb89b27558
RemcosRAT
2241716c3ddff7b1f771a6e3c91b67ded01e9f78026ecc124863099dbe5ac405
RemcosRAT
4ccc8a0286b73b62f34fee2f3927c12a73aa47f272f40a4ba7085d84dc1785aa
RemcosRAT
99f100122f5280ac44bc01f3bb7df9d3bd69681335e5f50d4ddfeca6e8ac3cb1
RemcosRAT
a2fad2958e6dd09d0d980d4e5d158c2a2eb18963d47fc95779c22bc2d203cb8e
RemcosRAT
cecec27d948d08eca8d94d9393903ce0af037d7375094ad4e988633d27af0415
RemcosRAT
eb1d3b24830e9b7370fbe2c0128d43f6ba9272b8990f73446e9137b299a369bd
RemcosRAT
+ 11'953 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:rh1 evasion persistence rat spyware stealer themida trojan
Link:
https://tria.ge/reports/220525-j6958ahda7/
Behaviour
Modifies registry class
Modifies registry key
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Adds Run key to start application
Checks whether UAC is enabled
Checks BIOS information in registry
Checks computer location settings
Deletes itself
Loads dropped DLL
Reads user/profile data of web browsers
Themida packer
Executes dropped EXE
Identifies VirtualBox via ACPI registry values (likely anti-VM)
NirSoft WebBrowserPassView
Nirsoft
Remcos
UAC bypass
Malware Config
C2 Extraction:
185.29.9.125:2404
Unpacked files
SH256 hash:
d2740adf962c9f403090e109357ac4a80d7cdca4576bfa72957ddcbf3af2af1d
MD5 hash:
a8d6c6bdd8adbbf02bdf133a0bf490d3
SHA1 hash:
df5a53660e8b1f4bbd3615ff52411a58f724b32b
Link:
https://www.unpac.me/results/962a5038-5246-45bf-8198-cdfb560d7737/
SH256 hash:
abde95665f00d689ae82d87023f15c909e8648e5d320b7fe680cdf910ec489ad
MD5 hash:
046804d6a8900b2fff9596823db0ce93
SHA1 hash:
0857ec6ee9d27042117d30a86f968ef6864d6e42
Link:
https://www.unpac.me/results/962a5038-5246-45bf-8198-cdfb560d7737/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/abde95665f00d689ae82d87023f15c909e8648e5d320b7fe680cdf910ec489ad

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_Themida
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with Themida
Rule name:INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer
Create hunting rule
Author:ditekSHen
Description:detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Rule name:remcos_rat
Create hunting rule
Author:jeFF0Falltrades

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RemcosRAT

Executable exe abde95665f00d689ae82d87023f15c909e8648e5d320b7fe680cdf910ec489ad

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2209682/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2209681/
Cape
Cape
https://www.capesandbox.com/analysis/274420/

Comments