MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ac2022d039991daaa6b3f05a7d2324b55247446b4f0b20f0feb36d22fd21d428. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 17


Intelligence 17 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ac2022d039991daaa6b3f05a7d2324b55247446b4f0b20f0feb36d22fd21d428
SHA3-384 hash: b552a366c34fdc3b36077c4625cd002c94d7b085c616531ff7a12790a07cde66c0bdf7f1fe0de5a4a2dd4f471ca37afb
SHA1 hash: 68b19e1f77e8a1c40431d0df5ff608f754fae9c4
MD5 hash: 1b1768684e3b4f4337a793669787e715
humanhash: jersey-kentucky-pennsylvania-carpet
File name:Revised PO-20221031_______________________.exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:454'278 bytes
First seen:2022-10-31 13:37:30 UTC
Last seen:2022-10-31 21:22:28 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 29b61e5a552b3a9bc00953de1c93be41 (174 x Formbook, 82 x AgentTesla, 81 x Loki)
ssdeep 12288:bZ8NStGCDxdRd6bRBiObo/w7FXb+pEfJnUvsq:bZ1ZUbjiOboYZXbMsq
Threatray 2'111 similar samples on MalwareBazaar
TLSH T155A4235374E2A8BBF60452F30922E396DB2D76154B2122C77F509F8A3324BCD8797547
TrID 48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
16.4% (.EXE) Win64 Executable (generic) (10523/12/4)
10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon b2a89c96a2cada72 (2'283 x Formbook, 981 x Loki, 803 x AgentTesla)
Reporter James_inthe_box
Tags:exe RemcosRAT

Intelligence

File Origin
# of uploads :
3
# of downloads :
356
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
remcos
Create hunting rule
ID:
1
File name:
Revised PO-20221031_______________________.exe
Verdict:
Malicious activity
Analysis date:
2022-10-31 13:39:43 UTC
Tags:
rat remcos
Link:
https://app.any.run/tasks/b4eb6b6b-7700-4497-a448-9a4eb0d1901b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/326436/
Detection(s):
Sanesecurity.Rogue.0hr.20221031-1340.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a file in the %AppData% subdirectories
Сreating synchronization primitives
Sending a custom TCP request
DNS request
Sending an HTTP GET request
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a recently created process by context flags manipulation
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/47014/overview
Behaviour
MalwareBazaar
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
babar overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/635fcfbb9eb103bc04e51dbe/reports/b9fe75ec-7df0-4b4f-bb3e-742640bc9d9a/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
REMCOS
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/6e1418c5-0027-4cb8-b948-e9231fbf03b2
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1101712
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to steal Chrome passwords or cookies
Delayed program exit found
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 734373 Sample: Revised PO-20221031________... Startdate: 31/10/2022 Architecture: WINDOWS Score: 100 46 Multi AV Scanner detection for domain / URL 2->46 48 Malicious sample detected (through community Yara rule) 2->48 50 Antivirus detection for URL or domain 2->50 52 4 other signatures 2->52 7 Revised PO-20221031_______________________.exe 18 2->7         started        10 xrydmfcs.exe 2->10         started        13 xrydmfcs.exe 2->13         started        process3 file4 30 C:\Users\user\AppData\Local\Temp\gdsjfy.exe, PE32 7->30 dropped 15 gdsjfy.exe 1 2 7->15         started        54 Multi AV Scanner detection for dropped file 10->54 56 Machine Learning detection for dropped file 10->56 58 Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors) 10->58 62 2 other signatures 10->62 19 xrydmfcs.exe 10->19         started        60 Maps a DLL or memory area into another process 13->60 21 xrydmfcs.exe 13->21         started        23 xrydmfcs.exe 13->23         started        signatures5 process6 file7 32 C:\Users\user\AppData\...\xrydmfcs.exe, PE32 15->32 dropped 38 Multi AV Scanner detection for dropped file 15->38 40 Machine Learning detection for dropped file 15->40 42 Contains functionality to steal Chrome passwords or cookies 15->42 44 2 other signatures 15->44 25 gdsjfy.exe 2 14 15->25         started        28 gdsjfy.exe 15->28         started        signatures8 process9 dnsIp10 34 41.216.183.226, 41900, 49702 AS40676US South Africa 25->34 36 geoplugin.net 178.237.33.50, 49703, 80 ATOM86-ASATOM86NL Netherlands 25->36
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ac2022d039991daaa6b3f05a7d2324b55247446b4f0b20f0feb36d22fd21d428/
Threat name:
Win32.Backdoor.Remcos
Create hunting rule
Status:
Malicious
First seen:
2022-10-31 07:40:08 UTC
File Type:
PE (Exe)
Extracted files:
4
AV detection:
29 of 42 (69.05%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=vqqcfubzteo2vjvt6bnh2izewvjeordlj4fsb4h6wnwsf7jb2qua._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
16f94dbc6345fd8220c180376a3074e966a8579b305d877b4714256d450141d0
RemcosRAT
31edb5c9a0590d100f941cfcb0c142abf141fba4a90c6bddb6c7fc59b4475f28
RemcosRAT
4bd1f385e71c2b0c8bb27ce271cfd26c696e3049e3e92cd150ba62666bc6221f
RemcosRAT
592f15fec50eda79baadcb6bc5c4cb79de60e5bb285f20fb8e8927477495f065
RemcosRAT
7fe73c463ac777aa61709aa357a27b09d8faae7833219399c3a92c6f692c11f4
RemcosRAT
9432004daa7e7748848e802b7a769efe47f147d54fcad12471d03d261c3bc5c0
RemcosRAT
ad87f3ad6fb14d2b79d7b7aac1b38bc04fd20757460da0f02cac139408df9969
RemcosRAT
d42107d756734247da36e67eb859e1ca7fefcdae69d5cd50730979d7b005e83d
RemcosRAT
e1eb708f47303b831f6eb0ddc846e21782e8f727dcb0088fcb997c3bf0d4dbd3
RemcosRAT
e68ebc948356b0560fee06f52939504005fd848a93ccc41b4840c1db318a5409
RemcosRAT
+ 2'101 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:remotehoststar persistence rat
Link:
https://tria.ge/reports/221031-qxdh8abag2/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Loads dropped DLL
Executes dropped EXE
Remcos
Malware Config
C2 Extraction:
41.216.183.226:41900
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/be484859-2a79-417c-accf-b1d11db6d199
Unpacked files
SH256 hash:
b004491771d05dc604c8f1a7b169673e9b7a7f33c4833bcfa50c5e76b8c9a1d8
MD5 hash:
b30ad3ec69c35a44bd720e88e07e283e
SHA1 hash:
52a834e399eb4fcac0a4bc0b1f53634da776aecf
Detections:
Remcos
Create hunting rule
win_remcos_auto
Create hunting rule
Link:
https://www.unpac.me/results/d54197d4-8587-4806-bf3a-67a79fcc0bb4/
Parent samples :
8573105c4b67affc024eec0b64c4f4c2f2e7f52d31b5eec059d6d8dc6f0a3743
0de500897b8ed984575c14906255f694bee3fdade7cc369f7c0a51185ec61ba0
76bf90f97131f4b187fbdfce5a1f02224e30a752782cbcd7f9a5d90a043de128
dae79c591e41fac5133e80652d94e8c1cc42e62381a38f2dc11c42360547afe7
f6d04e26f4e1ccafc73107d102606ed5e528fcb2e6451f568241b840152454ee
ac2022d039991daaa6b3f05a7d2324b55247446b4f0b20f0feb36d22fd21d428
522de9141cf7d1449c48f439b23bbc53be3de244e1baf817759b64eedfe5ae00
f9dbb342e635717b55ef19c20e7943858acf892e6040a9a4f3609eaa41981bc9
284749a242c7dcee6d5f8d71bb4de12ccbc7f7acc24a8fb795859b0393f23577
SH256 hash:
54583d9193205dbb151ce7857cbad3f586c1de1258553e1fe9ee89b359d35524
MD5 hash:
be57b5ca7f99d400f1be5de8af3cb4c3
SHA1 hash:
b57a6eeb6e3a3b0a220b3e3a6a5f9c21716b9f9b
Link:
https://www.unpac.me/results/d54197d4-8587-4806-bf3a-67a79fcc0bb4/
SH256 hash:
c49f86c553d6afaa4ad57b42877a3dfe4774104479abbaf29264a7627fd80890
MD5 hash:
dad0892e2ce177d2c1e38d6fffde8325
SHA1 hash:
1388a956a4a83548f2c43dc97739156ec9df12f9
Link:
https://www.unpac.me/results/d54197d4-8587-4806-bf3a-67a79fcc0bb4/
SH256 hash:
ac2022d039991daaa6b3f05a7d2324b55247446b4f0b20f0feb36d22fd21d428
MD5 hash:
1b1768684e3b4f4337a793669787e715
SHA1 hash:
68b19e1f77e8a1c40431d0df5ff608f754fae9c4
Link:
https://www.unpac.me/results/d54197d4-8587-4806-bf3a-67a79fcc0bb4/
Malware family:
Remcos
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/ac2022d03999/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.99
Link:
https://yomi.yoroi.company/submissions/ac2022d039991daaa6b3f05a7d2324b55247446b4f0b20f0feb36d22fd21d428

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

zip 13e77d6c6a416ec6d4c4807075f36be00b404ce59a61e0f26d5da65245b98846

RemcosRAT

Executable exe ac2022d039991daaa6b3f05a7d2324b55247446b4f0b20f0feb36d22fd21d428

(this sample)

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/326436/
  
Dropped by
SHA256 13e77d6c6a416ec6d4c4807075f36be00b404ce59a61e0f26d5da65245b98846
  
Dropped by
MD5 fd2abf35d12b7b0df13b20fd999bfc81

Comments