MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bc92297a5fc11628d6e7145c5cac90557c2714e1ce5b1017c084773950020fb9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bc92297a5fc11628d6e7145c5cac90557c2714e1ce5b1017c084773950020fb9
SHA3-384 hash: 24496e6c0ceb83ec1138df22f193d79726df62407d28e5e399864b2916ca5c510e335fdc07eadd470a2f2eceaf16f3ff
SHA1 hash: f8d7d1b76ab6d26e12c9e135acc3062b9da4cd3c
MD5 hash: 219fdd92220c1dd9d6d13f8c4a1cabf0
humanhash: texas-four-eighteen-video
File name:Quote 720945.zip
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:3'528 bytes
First seen:2022-08-30 20:31:15 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 96:vwx+dHAwysO/7m+N/kRPx/MNpMrBlBZzuolaBt:XdgwyI2kRSytlBxuvL
TLSH T13C715E6641B6E62BCD860430E16B41B5D31152D41B86E30F181BCE74FE2B55D160EEBC
TrID 80.0% (.ZIP) ZIP compressed archive (4000/1)
20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter cocaman
Tags:QUOTATION RemcosRAT zip


Avatar
cocaman
Malicious email (T1566.001)
From: "comercialmadvidro@gmail.com" (likely spoofed)
Received: "from hosted-by.rootlayer.net (unknown [45.137.22.239]) "
Date: "30 Aug 2022 02:27:07 +0200"
Subject: "Request For Quotation"
Attachment: "Quote 720945.zip"

Intelligence

File Origin
# of uploads :
1
# of downloads :
57
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.DownLoader45.14009.29840.23883.UNOFFICIAL
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/630e74793e9e50b1baedf78c/reports/3916795b-8a59-4d29-827a-1470fa2dd1a3/overview
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/bc92297a5fc11628d6e7145c5cac90557c2714e1ce5b1017c084773950020fb9
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bc92297a5fc11628d6e7145c5cac90557c2714e1ce5b1017c084773950020fb9/
Threat name:
ByteCode-MSIL.Downloader.PsDownload
Create hunting rule
Status:
Malicious
First seen:
2022-08-30 03:45:48 UTC
File Type:
Binary (Archive)
Extracted files:
2
AV detection:
17 of 40 (42.50%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xsjcs6s7yelcrvxhcrofzleqkv6cofhbzznraf6aqr3tsuacb64q._file
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:remotehost persistence rat
Link:
https://tria.ge/reports/220830-zbc51aaef7/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Checks computer location settings
Remcos
Malware Config
C2 Extraction:
172.111.234.100:5888
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.38
Link:
https://yomi.yoroi.company/submissions/bc92297a5fc11628d6e7145c5cac90557c2714e1ce5b1017c084773950020fb9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

zip bc92297a5fc11628d6e7145c5cac90557c2714e1ce5b1017c084773950020fb9

(this sample)

RemcosRAT

Executable exe 379dee3416757f21bec5a53af0cfda62fe0cadaeac03be81eabb3227ea47624b

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 379dee3416757f21bec5a53af0cfda62fe0cadaeac03be81eabb3227ea47624b
  
Dropping
RemcosRAT

Comments