MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ac97c3a053ab55f593422636036e20efbf978fdf6284723722e622fdb3d83373. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ac97c3a053ab55f593422636036e20efbf978fdf6284723722e622fdb3d83373
SHA3-384 hash: ed8132b02d98ef315c12d03535224d50ecdf0fa956d6acb0ff57750a8a622715d17fe8b15a86be0c63375f920eda7e31
SHA1 hash: b905c2863fe16dd87edfaa3f6b4931a583ea1a49
MD5 hash: 19612b7e95bc6e2d4c8f2631dbbee2ca
humanhash: ack-india-tennessee-december
File name:new order-100920-0086.pdf.vbs
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'969'583 bytes
First seen:2022-08-29 07:23:39 UTC
Last seen:Never
File type:Visual Basic Script (vbs) vbs
MIME type:text/plain
ssdeep 6144:rZIc8kPhMmxDd4HmHlP/EcQ14IeAy8yMhArBua1:racnPym8GF1T8ywAV
Threatray 15'605 similar samples on MalwareBazaar
TLSH T1AE95CB6D172E5164F59CF7065C9F06446E63E82A062244FF789F2E830D8FCEA7B9B520
Reporter abuse_ch
Tags:RemcosRAT vbs

Intelligence

File Origin
# of uploads :
1
# of downloads :
182
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/302070/
Result
Verdict:
UNKNOWN
Result
Threat name:
GuLoader, Remcos
Create hunting rule
Detection:
malicious
Classification:
evad.troj
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1059589
Signature
Antivirus detection for URL or domain
Encrypted powershell cmdline option found
Multi AV Scanner detection for domain / URL
Tries to detect Any.run
Uses an obfuscated file name to hide its real file extension (double extension)
Uses dynamic DNS services
Very long command line found
Wscript starts Powershell (via cmd or directly)
Yara detected GuLoader
Yara detected MSILDownloaderGeneric
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ac97c3a053ab55f593422636036e20efbf978fdf6284723722e622fdb3d83373/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vsl4hictvnk7le2cey3ag3ra567zpd67mkchenzc4yrp3m6ygnzq._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
cloudeye
Create hunting rule
Similar samples:
1832adc7abac176460e3ffb917603da35bd135b1d0fcaca1591a5481845ff1d2
RemcosRAT
28455b1a0b29240e95877cff96528b3a196f0cf3a63d9980dc70349cdc0e1e74
RemcosRAT
42848486deff7c04f76ad5d52d9ec293ffd07eae20d102781694db235106d459
RemcosRAT
56400d285883e72264ab693e17d3f94bb35df61618891768c8959932b5d9f140
RemcosRAT
576183a33f5247a852bc65a4dc4cbca5762bfbad1291a82572681f7075dc6123
RemcosRAT
617208cb1572a2d167753cb9a163fee04a6a5df5d75f555b14c79a1f3cb09d8e
RemcosRAT
6debeb4cbf5037ee3b4d23e3a005dc58ebb0f26ac5f5266e910187a66760a4a0
RemcosRAT
900274d5916f078ac30bedfc6b3bf5812c09de4cc1bdddd4e25d5efa1e3bb1c3
RemcosRAT
b07f08cbf908eb0d5c93679c8dca8438e4f185a70d675ad79184533dc6b4b262
RemcosRAT
f0ee700515bcc19a59d301204ffe8d612a7b39b79960b950299fb673d0c52116
RemcosRAT
+ 15'595 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:guloader family:remcos botnet:lucky downloader persistence rat
Link:
https://tria.ge/reports/220829-h8dpcsege3/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Adds Run key to start application
Checks QEMU agent file
Checks computer location settings
Guloader,Cloudeye
Remcos
Malware Config
C2 Extraction:
bustabantu1996.ddns.net:6699
bustabantu0817.duckdns.org:6699
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/ac97c3a053ab/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ac97c3a053ab55f593422636036e20efbf978fdf6284723722e622fdb3d83373

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Script_Comments_SUSP
Create hunting rule
Description:Detects suspicious scripts with a lot of commented text

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

Visual Basic Script (vbs) vbs ac97c3a053ab55f593422636036e20efbf978fdf6284723722e622fdb3d83373

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/302070/

Comments