MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ba8d32d0c7844fdd2e5c4311fc6dc7a400d7c1ff97bebd9760d62308c669fb8f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 17


Intelligence 17 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ba8d32d0c7844fdd2e5c4311fc6dc7a400d7c1ff97bebd9760d62308c669fb8f
SHA3-384 hash: 62e4fd6f6e0ba1baba09eefd3fb03a5573becf198c924ec995a6dd154435e34437e5020b043e304f3bdc53397e622dc3
SHA1 hash: 90d915f7953812ca0153a8e4a65c0e65a96c6fe8
MD5 hash: f38e504fbd59c1a0e71a4d2e381c3f9c
humanhash: alpha-spring-vegan-fish
File name:( PRE-ALERT) BL INF222300126.exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:512'095 bytes
First seen:2022-05-09 08:26:35 UTC
Last seen:2022-05-16 09:17:54 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 56a78d55f3f7af51443e58e0ce2fb5f6 (720 x GuLoader, 451 x Formbook, 295 x Loki)
ssdeep 12288:oNFYTACwfv7FOQHTjcGYRVFjaGeUSNZmlOE:oNFYTADfvRXzgPRTffl/
Threatray 1'190 similar samples on MalwareBazaar
TLSH T137B412617A19C48FE9E13AF504BDA9A36A656CB12470825F9BF07F753832943CC8D32D
TrID 48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
16.4% (.EXE) Win64 Executable (generic) (10523/12/4)
10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 174f4559191b1b13 (81 x AgentTesla, 68 x Formbook, 34 x SnakeKeylogger)
Reporter adrian__luca
Tags:exe RemcosRAT

Intelligence

File Origin
# of uploads :
2
# of downloads :
239
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
remcos
Create hunting rule
ID:
1
File name:
( PRE-ALERT) BL INF222300126.exe
Verdict:
Malicious activity
Analysis date:
2022-05-09 08:32:19 UTC
Tags:
remcos
Link:
https://app.any.run/tasks/50a2e52d-02f5-4a70-8587-b119c9e75435

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Trojan.NSISX.Spy.Gen.2.6896.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a file in the %AppData% subdirectories
Сreating synchronization primitives
Sending a custom TCP request
DNS request
Sending an HTTP GET request
Reading critical registry keys
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a recently created process
Unauthorized injection to a recently created process by context flags manipulation
Stealing user critical data
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/16769/overview
Behaviour
MalwareBazaar
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
control.exe overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/6278d073be0219041a870079/reports/f44f1fcc-cbf5-46fb-9b37-8e7da94f70f5/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
REMCOS
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/1c6cd378-210a-4f09-b9f9-973ae296243d
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/990030
Signature
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Found malware configuration
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file / registry access)
Tries to steal Mail credentials (via file registry)
Yara detected Remcos RAT
Yara detected WebBrowserPassView password recovery tool
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 622526 Sample: ( PRE-ALERT) BL  INF222300126.exe Startdate: 09/05/2022 Architecture: WINDOWS Score: 100 49 Found malware configuration 2->49 51 Malicious sample detected (through community Yara rule) 2->51 53 Icon mismatch, binary includes an icon from a different legit application in order to fool users 2->53 55 5 other signatures 2->55 8 ( PRE-ALERT) BL  INF222300126.exe 18 2->8         started        11 wvriarrqtfddba.exe 2->11         started        13 wvriarrqtfddba.exe 2->13         started        process3 file4 35 C:\Users\user\AppData\...\bojawlyxxv.exe, PE32 8->35 dropped 15 bojawlyxxv.exe 1 2 8->15         started        19 WerFault.exe 23 9 11->19         started        22 WerFault.exe 2 9 13->22         started        process5 dnsIp6 37 C:\Users\user\AppData\...\wvriarrqtfddba.exe, PE32 15->37 dropped 45 Detected unpacking (changes PE section rights) 15->45 47 Tries to steal Mail credentials (via file registry) 15->47 24 bojawlyxxv.exe 2 14 15->24         started        39 192.168.2.1 unknown unknown 19->39 file7 signatures8 process9 dnsIp10 41 172.94.88.13, 49772, 49775, 49777 SOFTLAYERUS United States 24->41 43 geoplugin.net 178.237.33.50, 49773, 80 ATOM86-ASATOM86NL Netherlands 24->43 57 Injects a PE file into a foreign processes 24->57 28 bojawlyxxv.exe 1 24->28         started        31 bojawlyxxv.exe 2 24->31         started        33 bojawlyxxv.exe 1 24->33         started        signatures11 process12 signatures13 59 Tries to steal Instant Messenger accounts or passwords 28->59 61 Tries to steal Mail credentials (via file / registry access) 28->61 63 Tries to harvest and steal browser information (history, passwords, etc) 31->63
Detection:
remcos
Create hunting rule
Link:
https://mwdb.cert.pl/sample/ba8d32d0c7844fdd2e5c4311fc6dc7a400d7c1ff97bebd9760d62308c669fb8f/
Threat name:
Win32.Backdoor.Remcos
Create hunting rule
Status:
Malicious
First seen:
2022-05-09 03:52:36 UTC
File Type:
PE (Exe)
Extracted files:
4
AV detection:
29 of 41 (70.73%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xkgtfughqrh52ls4imi7y3ohuqanpqp7s67l3f3a2yrqrrtj7ohq._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
1ccf09551ed031fa0755e2d2c22e05f8136cce389c5b6585d3f3395041637389
RemcosRAT
6d21985a34efde10ae60b32f3d1f309da2707f6421bdb78f1da14ec1341b22ec
RemcosRAT
6ea504859dafb477ac16b815e303fc121472298e1cbde707bf292b3432ec20e1
RemcosRAT
81a08b163648f4a09fbba230dc34b1b2c7e7e979fedc23c6bf89af0f39f32cff
RemcosRAT
81b648fca4135b631044dd68aee71ee704dcc930ae635658b9438585c5dc6b90
RemcosRAT
b8df890fac057175f86dc5f301f1e1f6d45b2a1b36598934c3fc0144cf433137
RemcosRAT
e2957cb5fb3bc6646533495ea0e907b852d768839e39cd49f362b2cb1ab53df9
RemcosRAT
e6a1d0c6cdb62e541492740eeabafe7f88f242d6a442fa0e2d2b4e8b1a2b1617
RemcosRAT
fafd7463254353a7e4ea4900b93f412fb84bbbddae730fc145c54331eb2533f8
RemcosRAT
+ 1'180 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:remotehost persistence rat
Link:
https://tria.ge/reports/220509-kcfvyscgf8/
Behaviour
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Adds Run key to start application
Loads dropped DLL
Executes dropped EXE
Remcos
Malware Config
C2 Extraction:
172.94.88.13:5888
Unpacked files
SH256 hash:
85b6ab786e2734cf0bbc6b5008363b6829978b43a4b84b493ca25d8e5dd10fc4
MD5 hash:
6604897b0923e0badf2c95017fc04016
SHA1 hash:
7a3335a905270c54841e747f68534b2d042455c8
Detections:
win_remcos_auto
Create hunting rule
Link:
https://www.unpac.me/results/6f08a60e-cb86-4be8-a246-51a911969b52/
Parent samples :
ba8d32d0c7844fdd2e5c4311fc6dc7a400d7c1ff97bebd9760d62308c669fb8f
576183a33f5247a852bc65a4dc4cbca5762bfbad1291a82572681f7075dc6123
6debeb4cbf5037ee3b4d23e3a005dc58ebb0f26ac5f5266e910187a66760a4a0
a9391048b93070a9917724955f78d6946074d241ed6c543ad0f36243830ee02b
SH256 hash:
d2aa981d03dc43fd50a0449b6870b354313a53ef54bee69eef75044fe31fe510
MD5 hash:
e07c3c2bf454469e66c22dbcf99c4b15
SHA1 hash:
abcc8825313e710597078fd6c2653590c91c5365
Link:
https://www.unpac.me/results/6f08a60e-cb86-4be8-a246-51a911969b52/
SH256 hash:
ba8d32d0c7844fdd2e5c4311fc6dc7a400d7c1ff97bebd9760d62308c669fb8f
MD5 hash:
f38e504fbd59c1a0e71a4d2e381c3f9c
SHA1 hash:
90d915f7953812ca0153a8e4a65c0e65a96c6fe8
Link:
https://www.unpac.me/results/6f08a60e-cb86-4be8-a246-51a911969b52/
Malware family:
Remcos
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/ba8d32d0c784/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ba8d32d0c7844fdd2e5c4311fc6dc7a400d7c1ff97bebd9760d62308c669fb8f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer
Create hunting rule
Author:ditekSHen
Description:detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Rule name:remcos_rat
Create hunting rule
Author:jeFF0Falltrades
Rule name:REMCOS_RAT_variants
Create hunting rule
Rule name:win_remcos_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.remcos.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

Executable exe ba8d32d0c7844fdd2e5c4311fc6dc7a400d7c1ff97bebd9760d62308c669fb8f

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments