MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 b626692f57e0e92f63368429dde7316b712d46e4d03472f75414a318630306eb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
RemcosRAT
Vendor detections: 14
| SHA256 hash: | b626692f57e0e92f63368429dde7316b712d46e4d03472f75414a318630306eb |
|---|---|
| SHA3-384 hash: | cb776f7f15811538b0e6959d98fa93f499e53b183fe40f701424691fdaeb49918786df9923a310ccd1c0649a09a79848 |
| SHA1 hash: | bccd2a265c82fa8f6695683623a89fa7dd4b7a8c |
| MD5 hash: | a4774d4a9b4cdd2ff22979be79ce231a |
| humanhash: | oregon-neptune-november-lamp |
| File name: | a4774d4a9b4cdd2ff22979be79ce231a.exe |
| Download: | download sample |
| Signature | RemcosRAT |
| File size: | 1'251'328 bytes |
| First seen: | 2022-10-11 10:20:46 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'454 x Formbook, 12'202 x SnakeKeylogger) |
| ssdeep | 24576:tcsZj6XnGZkllGo2dkb3+oW0zaJfGXjAnhYCYt:3Zj6WOladW3PaJWjAhYP |
| Threatray | 3'397 similar samples on MalwareBazaar |
| TLSH | T13C459CBA21C54417E8693079D487D2F32AFBAD606051D2C76AC72F6FBC811BF951338A |
| TrID | 72.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.4% (.EXE) Win64 Executable (generic) (10523/12/4) 6.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.4% (.EXE) Win32 Executable (generic) (4505/5/1) 2.0% (.EXE) OS/2 Executable (generic) (2029/13) |
| File icon (PE): |  |
| dhash icon | 08304c4d96966804 (4 x SnakeKeylogger, 3 x AgentTesla, 2 x Formbook) |
| Reporter |  abuse_ch |
| Tags: | exe RAT RemcosRAT |
Intelligence
File Origin
# of uploads :
1
# of downloads :
236
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Searching for the window
Creating a window
Unauthorized injection to a recently created process
Creating a file
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
packed
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
REMCOS
Verdict:
Malicious
Result
Threat name:
Remcos
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
.NET source code contains potential unpacker
C2 URLs / IPs found in malware configuration
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Sigma detected: Remcos
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected AntiVM3
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Detection:
remcos
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Status:
Malicious
First seen:
2022-10-09 17:10:26 UTC
File Type:
PE (.Net Exe)
Extracted files:
24
AV detection:
22 of 26 (84.62%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
remcos
Similar samples:
+ 3'387 additional samples on MalwareBazaar
Result
Malware family:
remcos
Score:
10/10
Tags:
family:remcos botnet:remotehost rat
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Remcos
Malware Config
C2 Extraction:
ban318937.sytes.net:1492
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Unpacked files
SH256 hash:
55b241bb560e6ea06f0d3e42be8ea9cb14135a2d7222cb2beb01f474026f9deb
MD5 hash:
00c5f5f98d70d27bc71b1e1baa2f0fe3
SHA1 hash:
f5633fe8bb359b15011ca8d609b125ed190c438c
SH256 hash:
3662c8c4f4bef1f215533dcbf308bb389acdfe198a3f658642d7df9adaed9dc2
MD5 hash:
e628e693e9878cfd829920778753764f
SHA1 hash:
88ca2f3a19ff12214222e814ae45e8a05a5187d4
SH256 hash:
1383999cb3682a0a0a54fad8a8e3f0fda2d4ce6422fa35286cece258aa1844a1
MD5 hash:
d891ee2f90e3392ee593067a038f3335
SHA1 hash:
347e96ac60f38938b0061ce5c21bec28c87f71f9
SH256 hash:
727028fff0346a098a3f87a2dba82f51780209254084b8fb717f2059442cd485
MD5 hash:
57a3b84c2eaeff9b2fd759e78061747f
SHA1 hash:
27e333b600bbd5016b910742bc249b7d9a61a4e8
Detections:
win_remcos_auto
Parent samples :
c699c6b1b668b088471e74e8ac09145ced97a45a0db6c59657040257fdc8508e
69372bffe2fde76d9ff14e2c60dd8ec83575a6da07ea03ccc5cfa35aeb78afc3
61a576cbf239d8e25ba3ea9109f42c1579287514f1a0921ae53c386c649dad67
440cf58dc6b8e4724c669e148969ecd8d424c9bf6dbdec6e358fdca7e72b3734
b626692f57e0e92f63368429dde7316b712d46e4d03472f75414a318630306eb
69372bffe2fde76d9ff14e2c60dd8ec83575a6da07ea03ccc5cfa35aeb78afc3
61a576cbf239d8e25ba3ea9109f42c1579287514f1a0921ae53c386c649dad67
440cf58dc6b8e4724c669e148969ecd8d424c9bf6dbdec6e358fdca7e72b3734
b626692f57e0e92f63368429dde7316b712d46e4d03472f75414a318630306eb
SH256 hash:
e20ec8f3c957bcb6a194ef688bae8af2015cfffb20e7baf8b2114d7b70ade4ee
MD5 hash:
35cb29046968faca7f3f3b4463449b6c
SHA1 hash:
088c8c30ec1bece0a4b5bbfe3982b073f8b95598
SH256 hash:
b626692f57e0e92f63368429dde7316b712d46e4d03472f75414a318630306eb
MD5 hash:
a4774d4a9b4cdd2ff22979be79ce231a
SHA1 hash:
bccd2a265c82fa8f6695683623a89fa7dd4b7a8c
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer |
|---|---|
| Author: | ditekSHen |
| Description: | detects Windows exceutables potentially bypassing UAC using eventvwr.exe |
| Rule name: | pe_imphash |
|---|
| Rule name: | Remcos |
|---|---|
| Author: | kevoreilly |
| Description: | Remcos Payload |
| Rule name: | REMCOS_RAT_variants |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
| Rule name: | win_remcos_auto |
|---|---|
| Author: | Felix Bilstein - yara-signator at cocacoding dot com |
| Description: | Detects win.remcos. |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.