MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ad09d1a6e737f2900eb85a8f92092d4c9065ba7b94902dc78ab900cbff166e82. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ad09d1a6e737f2900eb85a8f92092d4c9065ba7b94902dc78ab900cbff166e82
SHA3-384 hash: 1fe4585dbbce6a9b4d661626c9522a01e6ee2d11102b2122a121d29071ad2d6db4791feee7770171d64a0ee544e0cb97
SHA1 hash: b42499efc5cad69836bfd85e226bc088d62f05fe
MD5 hash: 93df98db8236868f5bd80ec14fe33a6c
humanhash: idaho-network-ten-yellow
File name:93df98db8236868f5bd80ec14fe33a6c
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'521'629 bytes
First seen:2021-06-24 03:54:27 UTC
Last seen:2021-06-24 04:44:53 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 650ed02ca4b6baad6b24f20402b6268b (7 x RedLineStealer, 1 x CryptBot, 1 x RemcosRAT)
ssdeep 24576:JChmYDQDXULmCiIhekpMYVBgqrQyTIhBri4oNGxL2GbPo8P9XT:JbSQDb8/V4yklSGxL2sT9XT
Threatray 261 similar samples on MalwareBazaar
TLSH A265E142B184DCF6D82316B2583AE520146ABE650B34C68F239DBA1E56F33823577F5F
Reporter zbetcheckin
Tags:32 exe RemcosRAT

Intelligence

File Origin
# of uploads :
2
# of downloads :
132
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
93df98db8236868f5bd80ec14fe33a6c
Verdict:
Suspicious activity
Analysis date:
2021-06-24 03:56:22 UTC
Tags:
rat remcos
Link:
https://app.any.run/tasks/6c2eb27f-2b27-415a-94b0-e52bb7f79e12

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
PUA.Win.Downloader.Driverpack-6998194-0
Create hunting rule

PUA.Win.Adware.Generic-7505646-0
Create hunting rule

PUA.Win.File.Generic-7557964-0
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/6461ad5d-2485-4c9c-b236-7b89aeadcbb0
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.spyw.evad
Score:
80 / 100
Link:
https://www.joesandbox.com/analysis/807127
Signature
Contains functionality to register a low level keyboard hook
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Obfuscated command line found
Submitted sample is a known malware sample
Uses nslookup.exe to query domains
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Writes to foreign memory regions
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 439538 Sample: As47eCZnpZ Startdate: 24/06/2021 Architecture: WINDOWS Score: 80 51 Multi AV Scanner detection for submitted file 2->51 53 Machine Learning detection for sample 2->53 10 As47eCZnpZ.exe 7 2->10         started        process3 signatures4 57 Contains functionality to register a low level keyboard hook 10->57 13 cmd.exe 1 10->13         started        process5 signatures6 59 Submitted sample is a known malware sample 13->59 61 Obfuscated command line found 13->61 63 Uses ping.exe to sleep 13->63 65 Uses ping.exe to check the status of other devices and networks 13->65 16 cmd.exe 3 13->16         started        19 conhost.exe 13->19         started        process7 signatures8 47 Obfuscated command line found 16->47 49 Uses ping.exe to sleep 16->49 21 Bel.exe.com 16->21         started        24 PING.EXE 1 16->24         started        27 findstr.exe 1 16->27         started        process9 dnsIp10 55 Uses nslookup.exe to query domains 21->55 30 Bel.exe.com 21->30         started        41 127.0.0.1 unknown unknown 24->41 43 192.168.2.1 unknown unknown 24->43 37 C:\Users\user\AppData\Local\...\Bel.exe.com, Targa 27->37 dropped file11 signatures12 process13 dnsIp14 45 PXBJECjdIHvvfvACvVUZukUKtdaV.PXBJECjdIHvvfvACvVUZukUKtdaV 30->45 67 Uses nslookup.exe to query domains 30->67 69 Writes to foreign memory regions 30->69 71 Injects a PE file into a foreign processes 30->71 34 nslookup.exe 1 30->34         started        signatures15 process16 dnsIp17 39 176.111.174.74, 4173, 49719 WILWAWPL Russian Federation 34->39
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ad09d1a6e737f2900eb85a8f92092d4c9065ba7b94902dc78ab900cbff166e82/
Threat name:
Win32.Trojan.Crypzip
Create hunting rule
Status:
Malicious
First seen:
2021-06-23 13:03:33 UTC
AV detection:
16 of 46 (34.78%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vue5djxhg7zjadvylkhzecjnjsiglot3ssic3r4kxeamx7ywn2ba._file
Verdict:
suspicious
Similar samples:
02b2395502a744108c7c09bafafb58af53016603294bdb780d667bb91c484363
RemcosRAT
06cf7c7c1a2d8f8647c977803466fd5b3a39dded0312fb23575eeacfaeaf07d6
RemcosRAT
4eb5daa7a830db220c094818f7e5f3bce013271465ceb32e13b66a5dcf36641a
RemcosRAT
530656ad87a4e5c0f07998323ebca34348af7c7a2e585196f2d0c73580832e36
RemcosRAT
8e8a09fbbc7eddbe0d27909b557a9e185a57eb0be431cb16fa363fd7ca5cd679
RemcosRAT
a2ed4456865129f69ed876a3262526d1193bc881708d46d86be1528f23c1b749
RemcosRAT
f611711bbcb210e6e679026be24fd78215dc623abfb926d6811274eec16a3ca7
RemcosRAT
f627cdcd4882aeee1329e0fb22e0cede29c0c743f40a002cbdbd1a4c2c6592ca
RemcosRAT
f87674db0a46d9903b10a9103dd2cad5b0d1ff7cccaaec2cc47231d5fc32007d
RemcosRAT
f9ea5610c7a0bb3fcf4380200e3056266e06819f0ae956ee96961211b1ef98a5
RemcosRAT
+ 251 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
upx
Link:
https://tria.ge/reports/210624-m1jc75h2vj/
Behaviour
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Suspicious use of SetThreadContext
Loads dropped DLL
Executes dropped EXE
UPX packed file
Suspicious use of NtCreateProcessExOtherParentProcess
Unpacked files
SH256 hash:
a3a2a3c99044599f964415c1e2f7927b3d804d70ef48a6fa00f0f3578e949f7c
MD5 hash:
90453de462d98d21bb19c186b10a6a60
SHA1 hash:
0c1c5f105ed9f6e963994b9877fcc147fc422816
Link:
https://www.unpac.me/results/3270fa48-54a5-4329-b578-17f2af2f1c73/
SH256 hash:
ad09d1a6e737f2900eb85a8f92092d4c9065ba7b94902dc78ab900cbff166e82
MD5 hash:
93df98db8236868f5bd80ec14fe33a6c
SHA1 hash:
b42499efc5cad69836bfd85e226bc088d62f05fe
Link:
https://www.unpac.me/results/3270fa48-54a5-4329-b578-17f2af2f1c73/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ad09d1a6e737f2900eb85a8f92092d4c9065ba7b94902dc78ab900cbff166e82

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RemcosRAT

Executable exe ad09d1a6e737f2900eb85a8f92092d4c9065ba7b94902dc78ab900cbff166e82

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1393507/

Comments