MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b7149d17821e8a67af81dc5cc7d7d09def03d6347e178434ec8923a1fcb74e66. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 15


Intelligence 15 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b7149d17821e8a67af81dc5cc7d7d09def03d6347e178434ec8923a1fcb74e66
SHA3-384 hash: 6d00b6114d6780d4dd70b72eae33bc41da7971c85bc5e863eb1bd73b3ace4ec859ef64a684b3c714ec0e765a45f57b3d
SHA1 hash: fb6f18175a93062ae6411391ef6e6a7d93616ec6
MD5 hash: 2ac719907a9d3149559874a1ae0feb28
humanhash: hamper-whiskey-sweet-mars
File name:file
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:433'664 bytes
First seen:2022-10-27 14:54:31 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash d5baaf7db716df76241a88766114f3b8 (3 x RemcosRAT)
ssdeep 6144:YbfRYSwUv9gMP3+U+hyTqG8ntSxuH1ujujg9BD7a8rfdJ9AOq2CXr93cvNFS2U:YrRrwU2M3+xGCTQjujgj9U2292zU
Threatray 2'076 similar samples on MalwareBazaar
TLSH T125948E11B981C432C1B211700E29FB769ABCBD212935597BA3E95D9BFE701C0B73A763
TrID 32.2% (.EXE) Win64 Executable (generic) (10523/12/4)
20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
15.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
13.7% (.EXE) Win32 Executable (generic) (4505/5/1)
6.2% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon c4d48eaa8ad4d4f8 (1'000 x RemcosRAT, 1 x Worm.Ramnit, 1 x Vjw0rm)
Reporter jstrosch
Tags:exe RemcosRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
241
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
remcos
Create hunting rule
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2022-10-27 15:01:16 UTC
Tags:
rat remcos
Link:
https://app.any.run/tasks/ddc5a5cc-fc8a-45ed-8372-d28024b73efa

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Remcos
Create hunting rule
Link:
https://www.capesandbox.com/analysis/324953/
Detection(s):
Win.Trojan.Remcos-9841897-0
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a file
Creating a window
Creating a file in the system32 subdirectories
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/46011/overview
Behaviour
MalwareBazaar
MeasuringTime
CheckCmdLine
EvasionQueryPerformanceCounter
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
REMCOS
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/c95e4bd4-0440-4a05-922f-f6d73343f295
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/1099761
Behaviour
Behavior Graph:
n/a
Detection:
remcos
Create hunting rule
Link:
https://mwdb.cert.pl/sample/b7149d17821e8a67af81dc5cc7d7d09def03d6347e178434ec8923a1fcb74e66/
Threat name:
Win32.Backdoor.Remcos
Create hunting rule
Status:
Malicious
First seen:
2022-10-04 16:05:24 UTC
File Type:
PE (Exe)
Extracted files:
8
AV detection:
22 of 26 (84.62%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=w4kj2f4cd2fgpl4b3rompv6qtxxqhvrupylyinhmrer2d7fxjzta._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
18f51c19c22914e634d9cfcd86018e676e91d1c4a9293c247a3c9da84dce3f60
RemcosRAT
1fbca7154111316e9d34ac02beb2377d20ca8426cc83669c89313a4a83358503
RemcosRAT
7a25e7868a967540a3dc4c8fa89f07444c4b714c4d2f3add235a7f0c33099c57
RemcosRAT
8865c82943ba3a6479fca40222a730e22e3d1cd279c6c6e0915c5c47f893636a
RemcosRAT
bcaf8f9bb1cda543a06ef101b8f4ac8228360400ec35a2ef2fba27b372ba75e7
RemcosRAT
d6ef67304b2eca589df643aa3e30a21ce7b835bb66b0d3856ece4e46e7217d6e
RemcosRAT
e962f44882a6fc4f5289556b7b0169b24838ea2285cf961b82447ff71ff2dc0d
RemcosRAT
+ 2'066 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:remotehost
Link:
https://tria.ge/reports/221027-sagcpscefr/
Behaviour
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Malware Config
C2 Extraction:
127.0.0.1:2404
Unpacked files
SH256 hash:
b7149d17821e8a67af81dc5cc7d7d09def03d6347e178434ec8923a1fcb74e66
MD5 hash:
2ac719907a9d3149559874a1ae0feb28
SHA1 hash:
fb6f18175a93062ae6411391ef6e6a7d93616ec6
Detections:
win_remcos_auto
Create hunting rule
Link:
https://www.unpac.me/results/5b57f08f-d5fb-44ad-95b6-58aecc954421/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b7149d17821e8a67af81dc5cc7d7d09def03d6347e178434ec8923a1fcb74e66

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Remcos
Create hunting rule
Author:kevoreilly
Description:Remcos Payload
Rule name:REMCOS_RAT_variants
Create hunting rule
Rule name:Windows_Trojan_Remcos_b296e965
Create hunting rule
Author:Elastic Security
Rule name:win_remcos_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.remcos.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RemcosRAT

Executable exe b7149d17821e8a67af81dc5cc7d7d09def03d6347e178434ec8923a1fcb74e66

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/324953/

Comments