MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bb6ccf663f9bdaa2bcc49e79c1e94b06a1d575c3132767eb5b0116f93b881cbd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bb6ccf663f9bdaa2bcc49e79c1e94b06a1d575c3132767eb5b0116f93b881cbd
SHA3-384 hash: 5aa168e3f22a5f23ab4da7fd1dad5d4f5a0f254b15f9a265d7bfaf0d64bf73cd36cb01c0eb00e2f3f39faed9d17cf9b5
SHA1 hash: 89c814a3b9d8a4245d38e982f8ac11c759e6f0ff
MD5 hash: 7f0b24167aec9cd87a971026e2cf8866
humanhash: ohio-wyoming-lion-oregon
File name:Document.exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'081'856 bytes
First seen:2021-11-04 10:23:05 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash a909072c8ac1c865a094bf6cee9a4d60 (6 x RemcosRAT, 5 x Formbook)
ssdeep 12288:JmF8ukZ1BjH652L9a3ZV6ImC/KGaIEfrcSjzMYIO3pxhOtFuhe3CL+NdJydmf:JywJjf9QVOg6zZ3nheu8swJ
TLSH T1F8359F317AF3A473C022293C591B9235AD36BFF42D266E491FA06D0B5FB69053A79C43
File icon (PE):PE icon
dhash icon 697110152b2b1530 (9 x RemcosRAT, 6 x Formbook)
Reporter abuse_ch
Tags:exe RemcosRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
122
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Document.exe
Verdict:
Malicious activity
Analysis date:
2021-11-04 10:48:11 UTC
Tags:
trojan rat remcos keylogger
Link:
https://app.any.run/tasks/18305988-6181-4b2d-8055-db1e71e5ebab

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/202229/
Detection(s):
SecuriteInfo.com.Artemis41EC449D4CEA.23656.22528.UNOFFICIAL
Create hunting rule

Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
keylogger
Link:
https://www.filescan.io/uploads/6183b4c4bf51178dbe4fb7b3/reports/96bb181c-65df-4326-9ae9-12de957dd603/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4ce15b45-72ab-4c37-acf8-e89e3c8c1706
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/883186
Signature
C2 URLs / IPs found in malware configuration
Creates a thread in another existing process (thread injection)
Detected Remcos RAT
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Writes to foreign memory regions
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bb6ccf663f9bdaa2bcc49e79c1e94b06a1d575c3132767eb5b0116f93b881cbd/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-11-04 10:24:05 UTC
AV detection:
16 of 28 (57.14%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xnwm6zr7tpnkfpgetz44d2kla2q5k5odcmtwp223aelpso4ids6q._file
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:remotehost persistence rat
Link:
https://tria.ge/reports/211104-mfdacagcc8/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Adds Run key to start application
Remcos
Malware Config
C2 Extraction:
rem1.camdvr.org:2404
rem16.hopto.org:2404
rem1666.hopto.org:2404
rem16.camdvr.org:2404
remmusic.freeddns.org:2404
sunwap1.ddns.net:2404
rem166.hopto.org:2404
Unpacked files
SH256 hash:
b54acef9838cff6393d79dda537a22d53898471f564b788cb435f9eb9c14260a
MD5 hash:
30ce6fdc8056eb47d2d9d08479cd1468
SHA1 hash:
1eb253077018219fead30b06acf756605d92dfeb
Detections:
win_temple_loader_w0
Create hunting rule
Link:
https://www.unpac.me/results/1ede6432-b529-4436-804f-ffe3b5be9555/
Parent samples :
8406a7711b994e88a676af2eb5c9ec007dc91004e440e866d0c4bda8dd6e04ab
076b28855c1f83d5ee34627d5cd6991840e32767415837fd950617a0486b19cb
1cdcb4a583816fc3478e46c2db3d523332c4e88b0335501e31a6a0bf7084871f
6aece77e910abb363eae0ce97965198b89685a37414472be0320c88a9f5a44b3
2ca64cfb392dd47b94764fd043ef8aa654cda9a022668d94d99725d197fc3da6
0892f3b3de736822be2fa4913317b3926526e3289f9cf05a4015e5f9f01bef91
bb6ccf663f9bdaa2bcc49e79c1e94b06a1d575c3132767eb5b0116f93b881cbd
5b1f147d44d76bb57854bab35c1ed7c5b20d85868c9727c01f4c6ca826bbe6dd
a4c57d9643f299829a1239d5142a1aa19f89cc75de74501f656f03df0150c8ea
f4097221e19342e5b91103161eb7aaec277ff47ea694a86b92f7574be7959cc7
e6d92da520f7537c283b5a1424651263a2098a4b97e7f3b655cabed43b15015b
408d06eb0f8df445f72b771e26fac033f6a71f867d1bb5a1f78320e99b30d331
84e88e073e0fba18a2b05e25bb904a26cdb9f800ef7c6d39d85daacd88c56b76
1d7800d50de8019f5f30a281730f4a77a39b14bff8bc385a302508eed2cfa5be
85ba079f07da66a80dee82f93da2a0cd002d1cbd00bd285011288b04340a8d52
SH256 hash:
bb6ccf663f9bdaa2bcc49e79c1e94b06a1d575c3132767eb5b0116f93b881cbd
MD5 hash:
7f0b24167aec9cd87a971026e2cf8866
SHA1 hash:
89c814a3b9d8a4245d38e982f8ac11c759e6f0ff
Link:
https://www.unpac.me/results/1ede6432-b529-4436-804f-ffe3b5be9555/
Malware family:
Remcos
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/bb6ccf663f9b/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Remcos
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/bb6ccf663f9bdaa2bcc49e79c1e94b06a1d575c3132767eb5b0116f93b881cbd

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/202229/

Comments