MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ac7983522d429ba0141b567f6e7606e4c8f11065f976f306c4222a2110d8a2da. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 16


Intelligence 16 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ac7983522d429ba0141b567f6e7606e4c8f11065f976f306c4222a2110d8a2da
SHA3-384 hash: 87103062b9e91bf9fe64d574254b903f18b0ef42a66a995284dbef7fe2b4852a768b349d0a126add75bda8ece8737869
SHA1 hash: c0391ea6092566d7b677654fd45201cb918691e7
MD5 hash: 97ac244e63698142243cb11825c447dd
humanhash: friend-tennis-early-high
File name:97ac244e63698142243cb11825c447dd.exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'149'440 bytes
First seen:2023-06-10 09:59:57 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'659 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 24576:7MPe2HlWxMiQW/O4ue7FNNepebHhRNL7H/mfj+K67xxn0XGKINZcfpoQQXj:OZlYMiQWmS7tz7t7kyKax904Ofpfc
TLSH T1E835120862FAEB19C87E7FFC08D4947183F0605A3556E78A4EC378DA1E75B058F419AB
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):PE icon
dhash icon e08c0f2322073bc0 (10 x AgentTesla, 6 x Formbook, 3 x SnakeKeylogger)
Reporter abuse_ch
Tags:exe RAT RemcosRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
282
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
remcos
Create hunting rule
ID:
1
File name:
97ac244e63698142243cb11825c447dd.exe
Verdict:
Malicious activity
Analysis date:
2023-06-10 10:02:17 UTC
Tags:
keylogger remcos
Link:
https://app.any.run/tasks/beb36b5f-004a-4939-8347-2d145054355e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Remcos
Create hunting rule
Link:
https://www.capesandbox.com/analysis/397508/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.67386631.8030.4361.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Unauthorized injection to a recently created process
Creating a file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
lolbin packed
Link:
https://www.filescan.io/uploads/648449a339ba775c46e0f323/reports/82d3661a-c777-4185-a4d4-73f4526bf241/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/ac7983522d429ba0141b567f6e7606e4c8f11065f976f306c4222a2110d8a2da
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
REMCOS
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/30b1a0fd-17ac-420e-8725-23976759bfa8
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1252356
Signature
.NET source code contains potential unpacker
C2 URLs / IPs found in malware configuration
Contains functionality to bypass UAC (CMSTPLUA)
Contains functionality to modify clipboard data
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Delayed program exit found
Found malware configuration
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sigma detected: Remcos
Yara detected Remcos RAT
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
Detection:
remcos
Create hunting rule
Link:
https://mwdb.cert.pl/sample/ac7983522d429ba0141b567f6e7606e4c8f11065f976f306c4222a2110d8a2da/
Threat name:
ByteCode-MSIL.Trojan.Remcos
Create hunting rule
Status:
Malicious
First seen:
2023-06-05 11:10:30 UTC
File Type:
PE (.Net Exe)
Extracted files:
24
AV detection:
25 of 37 (67.57%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vr4ygurnikn2afa3kz7w45qg4tepcedf7f3pgbweeivccegyulna._file
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:searose rat
Link:
https://tria.ge/reports/230610-l1mh3sfc8x/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Remcos
Malware Config
C2 Extraction:
seanblacin.sytes.net:6110
Unpacked files
SH256 hash:
2f13f4db3405dfac3dd2945be3de440607b6e8479951c2630823009700083953
MD5 hash:
084fd7e237ece48508277cdfd578e47d
SHA1 hash:
f152839ca9518552e41320c8b3bab96d01a911e5
Link:
https://www.unpac.me/results/33724df3-6f23-4fd1-94ee-c0c3eb2c1ef6/
SH256 hash:
c440617e04a50ced73c8ab992cbe8d8954a3e41f21f046ee9d1f2a41ea9b416d
MD5 hash:
9390df6c9a6111978dee5414bc42eda6
SHA1 hash:
d3cb1c366b9e466afa93eb369838a04d30777795
Link:
https://www.unpac.me/results/33724df3-6f23-4fd1-94ee-c0c3eb2c1ef6/
SH256 hash:
25b31e7409399a47b785bff555662e30e5aebb38d6f1414db9826f9b1ad157a6
MD5 hash:
7b224d3106233663633ea87c84a6b30e
SHA1 hash:
96abb0868d794bb70ac92a45c57a5c97c0ad6fc2
Detections:
Remcos
Create hunting rule
win_remcos_auto
Create hunting rule
Link:
https://www.unpac.me/results/33724df3-6f23-4fd1-94ee-c0c3eb2c1ef6/
Parent samples :
c57ef56c3465d7d32b6851cdfd6d950fbbc53a40c825f547f4b4cc0f01123346
5b1e8d8e1c47866009a79f371befaff9f673cb07656a0eb9509771dffd8f7ea7
d935d16b1603eb83d9c8587e3fe36ba247341adb572bac99a291f35bd13d7292
ac7983522d429ba0141b567f6e7606e4c8f11065f976f306c4222a2110d8a2da
SH256 hash:
527c8f8e660895083055fe1a000ff3a7a60238a6b44b480c997e98873f0c4ded
MD5 hash:
ff4230f6c211fb28c719c9aec42c0fa8
SHA1 hash:
02a6ee26515b63862f9189f45ad0e8d4e3229e1f
Link:
https://www.unpac.me/results/33724df3-6f23-4fd1-94ee-c0c3eb2c1ef6/
SH256 hash:
23d5da2d3edeaffe0ab3c0db1eaba35f1f774add240bc4b428579617fec4b38c
MD5 hash:
2b2870a09946e70a9dd8bd48e5d6b955
SHA1 hash:
02835f138941b29a74822802fc9a9923f6c59701
Link:
https://www.unpac.me/results/33724df3-6f23-4fd1-94ee-c0c3eb2c1ef6/
SH256 hash:
ac7983522d429ba0141b567f6e7606e4c8f11065f976f306c4222a2110d8a2da
MD5 hash:
97ac244e63698142243cb11825c447dd
SHA1 hash:
c0391ea6092566d7b677654fd45201cb918691e7
Link:
https://www.unpac.me/results/33724df3-6f23-4fd1-94ee-c0c3eb2c1ef6/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/ac7983522d42/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ac7983522d429ba0141b567f6e7606e4c8f11065f976f306c4222a2110d8a2da

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RemcosRAT

Executable exe ac7983522d429ba0141b567f6e7606e4c8f11065f976f306c4222a2110d8a2da

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/397508/
  
URLhaus
https://urlhaus.abuse.ch/url/2641293/
  
Delivery method
Distributed via web download

Comments