🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ba821e2f6571df5cee19a5418cbf07983f71ceb9f3c01da2bebfd9832cb698f3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 13


Intelligence 13 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ba821e2f6571df5cee19a5418cbf07983f71ceb9f3c01da2bebfd9832cb698f3
SHA3-384 hash: 2b44618b0c04b6f27da636bef71c11a6d607ac81615260eb970177f70cd5b6ad6a196a12bcd69098933c8b24b5b661b3
SHA1 hash: 9f81297f4d2bf82a35f79f5fd9885d8cb8214fa1
MD5 hash: 7422529e2fabf5d88c882e9ab8020f37
humanhash: north-salami-quebec-oxygen
File name:WECC2263FXT1385.exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:631'016 bytes
First seen:2022-12-19 15:23:38 UTC
Last seen:2022-12-24 09:17:50 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'239 x AgentTesla, 20'490 x Formbook, 12'372 x SnakeKeylogger)
ssdeep 12288:3SVTjSqmCt38XNBFvsDaNXc6e+f3gdJrXVNqYCi/fI:31Zo8XNne8Qnr6YN3
Threatray 3'225 similar samples on MalwareBazaar
TLSH T12BD40184321AE8BEC44E98FAEE57DEDB8D10111E63874352443AD05752A97FE87A3CF1
TrID 28.5% (.EXE) Win64 Executable (generic) (10523/12/4)
17.8% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
13.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
12.2% (.EXE) Win32 Executable (generic) (4505/5/1)
5.6% (.EXE) Win16/32 Executable Delphi generic (2072/23)
File icon (PE):PE icon
dhash icon 30b2c4c8c8c4b030 (53 x Formbook, 41 x RemcosRAT, 20 x AgentTesla)
Reporter James_inthe_box
Tags:exe RemcosRAT

Intelligence

File Origin
# of uploads :
3
# of downloads :
189
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
remcos
Create hunting rule
ID:
1
File name:
WECC2263FXT1385.exe
Verdict:
Malicious activity
Analysis date:
2022-12-19 15:24:04 UTC
Tags:
rat remcos
Link:
https://app.any.run/tasks/10a7ea4d-7369-41c4-9d83-10d7fb29346b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Remcos
Create hunting rule
Link:
https://www.capesandbox.com/analysis/348041/
Detection(s):
PUA.Win.Packed.ConfuserEx-6391397-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Creating a file
Сreating synchronization primitives
DNS request
Sending a custom TCP request
Sending an HTTP GET request
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Unauthorized injection to a system process
Enabling autorun by creating a file
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
barys overlay packed
Link:
https://www.filescan.io/uploads/63a08213329e69a36441aa3b/reports/40eb3492-a130-4531-b50b-e344c5362bc7/overview
Malware family:
REMCOS
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/0a4a57e3-5c93-4ac0-b982-7b597ffef6d3
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
spre.troj.adwa.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1137311
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Drops PE files to the startup folder
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file contains section with special chars
PE file has nameless sections
Powershell drops PE file
Sigma detected: Copy file to startup via Powershell
Sigma detected: Remcos
Yara detected AntiVM3
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 770050 Sample: WECC2263FXT1385.exe Startdate: 19/12/2022 Architecture: WINDOWS Score: 100 37 Multi AV Scanner detection for domain / URL 2->37 39 Malicious sample detected (through community Yara rule) 2->39 41 Antivirus detection for dropped file 2->41 43 12 other signatures 2->43 7 WECC2263FXT1385.exe 1 2->7         started        10 System.exe 1 2->10         started        process3 file4 27 C:\Users\user\...\WECC2263FXT1385.exe.log, ASCII 7->27 dropped 12 powershell.exe 14 7->12         started        16 RegSvcs.exe 2 14 7->16         started        19 powershell.exe 3 10->19         started        21 RegSvcs.exe 10->21         started        process5 dnsIp6 29 C:\Users\user\AppData\Roaming\...\System.exe, PE32 12->29 dropped 31 C:\Users\user\...\System.exe:Zone.Identifier, ASCII 12->31 dropped 45 Drops PE files to the startup folder 12->45 47 Powershell drops PE file 12->47 23 conhost.exe 12->23         started        33 gdyhjjdhbvxgsfe.gotdns.ch 37.139.129.71, 2718, 49698 LVLT-10753US Germany 16->33 35 geoplugin.net 178.237.33.50, 49699, 80 ATOM86-ASATOM86NL Netherlands 16->35 49 Installs a global keyboard hook 16->49 25 conhost.exe 19->25         started        file7 signatures8 process9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ba821e2f6571df5cee19a5418cbf07983f71ceb9f3c01da2bebfd9832cb698f3/
Threat name:
Win32.Exploit.BypassUac
Create hunting rule
Status:
Malicious
First seen:
2022-12-19 09:56:35 UTC
File Type:
PE (.Net Exe)
Extracted files:
6
AV detection:
23 of 26 (88.46%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xkbb4l3fohpvz3qzuvayzpyhta7xdtvz6pab3iv6x7myglfwtdzq._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
0359874ac9be35e969500ffe552298ea0c8056b51c8eac0e3e835c564ef39148
RemcosRAT
139d0b13776f8fea46db2d77f0391b480cf290abcca453aacd2e003e7a618787
RemcosRAT
2534dc5de6f04a5706c03767505e8f2e0c57e95d9129bdf039f0564167f57837
RemcosRAT
47884208f8a644ae2107eecef208a905e03839cb331ccf0dc6c50a72e969b17a
RemcosRAT
73f93753808172cbab4fbca1e6d8beb8426cf57d1ff000973864d79db32f1054
RemcosRAT
8eeee12ec07cb66de78247ff89429970d6fddd4439813520ac1627350f42dfcc
RemcosRAT
9735527911fe79127bb4cac6cab68bb6e3da29592921e1cfbfcd496245aeb74f
RemcosRAT
c8f7124c43eb317024e9e329f6a05b8e278b3c6ac99a2f202406b719dbb815ca
RemcosRAT
cc1b3f4781e52795a027671e7248ac7b4a4346f104795fd2aa341768c6434cf4
RemcosRAT
cfc1ce14ea47f2cd1bfe204a9f6c3bc90cce83c7f4714b22e13bdba3a0f2ab24
RemcosRAT
+ 3'215 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:awele-host rat
Link:
https://tria.ge/reports/221219-ss15tsfc87/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Drops startup file
Remcos
Malware Config
C2 Extraction:
gdyhjjdhbvxgsfe.gotdns.ch:2718
Unpacked files
SH256 hash:
a75ae79e0d516c294d3879e3c2cd4adf87414602defabd665f0ff3b3e55b5b07
MD5 hash:
58e4286280344b45355fe972903085b9
SHA1 hash:
c447c9194c7d8a81916b0f5ce18736b727e31110
Detections:
Remcos
Create hunting rule
win_remcos_auto
Create hunting rule
Link:
https://www.unpac.me/results/f8c42d9a-e392-4208-95cf-2e5aec23976c/
Parent samples :
4c01a5efdf9e70d2c32d34b2c6ce2d7f4799d8d98dcc5d620ee4f91bb59feb64
51e7e1fb70ff8635dc9a73ae9a71193c3e464c1a98b609d7ca5b3837046a566f
28c1e1189f15a7c38cf855f0c5f7b9e5c0b60a24ea71debbf91308c1e63da360
ba821e2f6571df5cee19a5418cbf07983f71ceb9f3c01da2bebfd9832cb698f3
604c33e83b2aad9f1212a859584fa9ca71e1d2f8bdc42267e63d82400159498e
610a60f20df8a45432f678a6dd4876de7f87be020dc14c3ddb2a6a9179a3cff5
1f88829425d3e18a66b2327a1d21f4f5881b92ab8cce935b5e89b62403d4f9cf
SH256 hash:
fd56a07f2da75c84337cbf94e0acafc09fb909cfb187a0ae214827ce2c4708bb
MD5 hash:
d93c5f59ddc41313bf36f106a2f1fe17
SHA1 hash:
97c5cd9d0689c1cd74685bc979122a13eba3fcc9
Link:
https://www.unpac.me/results/f8c42d9a-e392-4208-95cf-2e5aec23976c/
SH256 hash:
ba821e2f6571df5cee19a5418cbf07983f71ceb9f3c01da2bebfd9832cb698f3
MD5 hash:
7422529e2fabf5d88c882e9ab8020f37
SHA1 hash:
9f81297f4d2bf82a35f79f5fd9885d8cb8214fa1
Link:
https://www.unpac.me/results/f8c42d9a-e392-4208-95cf-2e5aec23976c/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/ba821e2f6571/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/ba821e2f6571df5cee19a5418cbf07983f71ceb9f3c01da2bebfd9832cb698f3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_ConfuserEx
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with ConfuserEx Mod
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/348041/

Comments