MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b534709b0de0c4392af03fea261580b08915ae1e5a55496f85dc21500c6a8338. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 11


Intelligence 11 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b534709b0de0c4392af03fea261580b08915ae1e5a55496f85dc21500c6a8338
SHA3-384 hash: 79892bd3b27e809dd24a199473234c6eb898a3c384f249568480cf174e55ab812da2064e94034eece374fbcf92012314
SHA1 hash: 5e798d2e1cef9a9399a9e149b0de97af6cc37763
MD5 hash: 0f560b90721e1a3b4b5faef80c17bbfb
humanhash: lion-aspen-angel-william
File name:0f560b90721e1a3b4b5faef80c17bbfb.exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:448'984 bytes
First seen:2023-02-12 14:27:59 UTC
Last seen:2023-02-12 16:28:55 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash b78ecf47c0a3e24a6f4af114e2d1f5de (295 x GuLoader, 23 x Formbook, 21 x RemcosRAT)
ssdeep 12288:p/ROa5165KMPDIAY8VQMZGxCgLNPvlvkENW:X5MVrIAXQMZnQPvV0
Threatray 17'298 similar samples on MalwareBazaar
TLSH T153A4F1957A909503C49AAF7959B7F33D9136AB247E87470BB7343B692F32B907D002C2
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 62609cdac9c282e8 (1 x RemcosRAT, 1 x AveMariaRAT)
Reporter abuse_ch
Tags:exe RAT RemcosRAT signed

Code Signing Certificate

Organisation:Unginned
Issuer:Unginned
Algorithm:sha256WithRSAEncryption
Valid from:2022-10-25T22:32:33Z
Valid to:2025-10-24T22:32:33Z
Serial number: 3794fd4cb5fbbed4
Thumbprint Algorithm:SHA256
Thumbprint: ab96a32f34a888ba6b663b7ddfb99d60d1cb2983f447af070ee0ce27867740c6
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
2
# of downloads :
213
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
0f560b90721e1a3b4b5faef80c17bbfb.exe
Verdict:
Malicious activity
Analysis date:
2023-02-12 14:29:18 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/3758e737-dfa6-47bd-ad02-c53c6aa402e3

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/364453/
Detection(s):
SecuriteInfo.com.Variant.Jaik.118202.2602.20428.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Creating a window
Creating a file
Delayed reading of the file
Creating a file in the %temp% subdirectories
Sending a custom TCP request
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/68554/overview
Behaviour
MalwareBazaar
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
buer guloader
Link:
https://www.filescan.io/uploads/63e8f777843466d9d5fe1737/reports/a1d2937e-d368-4e14-9c82-21c31bccb1b6/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_60%
Link:
https://www.hybrid-analysis.com/sample/b534709b0de0c4392af03fea261580b08915ae1e5a55496f85dc21500c6a8338
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/ca19f457-e383-4fc6-b98f-faeb011d46f8
Result
Threat name:
GuLoader
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
80 / 100
Link:
https://www.joesandbox.com/analysis/1172604
Signature
Creates an undocumented autostart registry key
Creates multiple autostart registry keys
Disables UAC (registry)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Tries to detect Any.run
Yara detected GuLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 805394 Sample: CyqOwDzwhY.exe Startdate: 12/02/2023 Architecture: WINDOWS Score: 80 56 googlehosted.l.googleusercontent.com 2->56 58 drive.google.com 2->58 60 doc-0o-ac-docs.googleusercontent.com 2->60 66 Multi AV Scanner detection for dropped file 2->66 68 Multi AV Scanner detection for submitted file 2->68 70 Yara detected GuLoader 2->70 9 CyqOwDzwhY.exe 21 2->9         started        13 Uncursed.exe 15 2->13         started        15 Task Manager.exe 15 2->15         started        17 Uncursed.exe 2->17         started        signatures3 process4 file5 48 C:\Users\user\AppData\Local\...\System.dll, PE32 9->48 dropped 80 Tries to detect Any.run 9->80 19 CyqOwDzwhY.exe 5 12 9->19         started        50 C:\Users\user\AppData\Local\...\System.dll, PE32 13->50 dropped 82 Multi AV Scanner detection for dropped file 13->82 24 Uncursed.exe 13->24         started        52 C:\Users\user\AppData\Local\...\System.dll, PE32 15->52 dropped 26 WerFault.exe 21 15->26         started        54 C:\Users\user\AppData\Local\...\System.dll, PE32 17->54 dropped 28 WerFault.exe 17->28         started        signatures6 process7 dnsIp8 62 googlehosted.l.googleusercontent.com 142.250.186.65, 443, 49847, 49861 GOOGLEUS United States 19->62 64 drive.google.com 172.217.16.142, 443, 49846, 49860 GOOGLEUS United States 19->64 44 C:\Users\user\AppData\Local\...\Uncursed.exe, PE32 19->44 dropped 46 C:\ProgramData\Windows\Task Manager.exe, PE32 19->46 dropped 74 Creates an undocumented autostart registry key 19->74 76 Creates multiple autostart registry keys 19->76 78 Tries to detect Any.run 19->78 30 cmd.exe 1 19->30         started        32 Task Manager.exe 15 19->32         started        file9 signatures10 process11 file12 35 reg.exe 1 30->35         started        38 conhost.exe 30->38         started        42 C:\Users\user\AppData\Local\...\System.dll, PE32 32->42 dropped 40 WerFault.exe 21 16 32->40         started        process13 signatures14 72 Disables UAC (registry) 35->72
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b534709b0de0c4392af03fea261580b08915ae1e5a55496f85dc21500c6a8338/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2023-02-10 17:59:00 UTC
File Type:
PE (Exe)
Extracted files:
4
AV detection:
16 of 39 (41.03%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wu2hbgyn4dcdskxqh7vcmfmawcerllq6ljkus34f3qqvaddkqm4a._file
Verdict:
malicious
Similar samples:
0446426011545933db1f091adb7c478d152f156eab919451090106cfa6eefdc9
RemcosRAT
12748aea84778652c1b2fef43117bdb42de3061f4a4376927ca27154cce42013
RemcosRAT
12aac5d4158e47940eefe3ccea78ba7390872b2afedae626a9783b2ae2a76632
RemcosRAT
19905bdf0cb29dfbc07442ef68e3f5d58b1c6e80dbd051d558ed272e60b3269c
RemcosRAT
1c6bd398f9ee650ad9fd68a74846a169b61fbef689ee6abf8fb68962ccea4041
RemcosRAT
5f6dea89dedfcd5dbe36191a81d6bd4379111e78884444acc4777cc5c19e8b83
RemcosRAT
877a377b2985392ec6b261d53b6f20aa5ee4d2a96580a8991bca017b1f160cf5
RemcosRAT
99d7076ecdb6a3ac9bc89ebae32af757b66c27c4608d31f1c9cf1d4c0492ba04
RemcosRAT
ff2c1d0bdc27e3137837afac350c6e433e86d4523f32555b3b59de1aa0981c53
RemcosRAT
+ 17'288 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:guloader family:remcos botnet:remotehost downloader evasion persistence rat trojan
Link:
https://tria.ge/reports/230212-rs1cvsee86/
Behaviour
Modifies registry key
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
NSIS installer
Enumerates physical storage devices
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Adds Run key to start application
Legitimate hosting services abused for malware hosting/C2
Checks QEMU agent file
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Adds policy Run key to start application
Guloader,Cloudeye
Remcos
UAC bypass
Malware Config
C2 Extraction:
masterpat0nms672ns.duckdns.org:3256
Unpacked files
SH256 hash:
fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e
MD5 hash:
3f176d1ee13b0d7d6bd92e1c7a0b9bae
SHA1 hash:
fe582246792774c2c9dd15639ffa0aca90d6fd0b
Link:
https://www.unpac.me/results/9a16c726-f642-4d87-8a9c-730ddb782c73/
SH256 hash:
b534709b0de0c4392af03fea261580b08915ae1e5a55496f85dc21500c6a8338
MD5 hash:
0f560b90721e1a3b4b5faef80c17bbfb
SHA1 hash:
5e798d2e1cef9a9399a9e149b0de97af6cc37763
Link:
https://www.unpac.me/results/9a16c726-f642-4d87-8a9c-730ddb782c73/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/b534709b0de0c4392af03fea261580b08915ae1e5a55496f85dc21500c6a8338

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:adonunix2
Create hunting rule
Author:Tim Brown @timb_machine
Description:AD on UNIX
Rule name:Ins_NSIS_Buer_Nov_2020_1
Create hunting rule
Author:Arkbird_SOLG
Description:Detect NSIS installer used for Buer loader

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/364453/

Comments