MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bd0baa9f0e69f70c827e05b8bae5a4b34f04b21be971c39e3831d584140d08d3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 14


Intelligence 14 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bd0baa9f0e69f70c827e05b8bae5a4b34f04b21be971c39e3831d584140d08d3
SHA3-384 hash: e2110bc9f0e3a62475ddef532101daeb3da6bf4115271bca83d1b9de7ea92fd973bdf4b7de3e858099fcc7b49ca4842c
SHA1 hash: 478d77fe1dcba768fbb30f8c845349dd0ffa1d32
MD5 hash: 12cfdbcb62a3ec5f9de2c5c2efc759d5
humanhash: carbon-arkansas-coffee-nevada
File name:bd0baa9f0e69f70c827e05b8bae5a4b34f04b21be971c39e3831d584140d08d3
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:469'056 bytes
First seen:2021-10-08 12:51:21 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash ec8ea73e2aa6f868311acc5b792bc222 (10 x RemcosRAT)
ssdeep 12288:wYe6UWhaT5xnDdLv9rX+1jZJqxE/ZjEcyibX:m6UWUT5xDN9IjZJsCZ3ygX
Threatray 707 similar samples on MalwareBazaar
TLSH T119A49D12B991C032C17212700D69FB759ABCBD202D3549BB73E96D5BFE710C1BB2A663
File icon (PE):PE icon
dhash icon c4d48eaa8ad4d4f8 (1'000 x RemcosRAT, 1 x Worm.Ramnit, 1 x Vjw0rm)
Reporter JAMESWT_WT
Tags:exe officialsw chickenkiller com RemcosRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
274
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
bd0baa9f0e69f70c827e05b8bae5a4b34f04b21be971c39e3831d584140d08d3
Verdict:
Malicious activity
Analysis date:
2021-10-08 13:03:21 UTC
Tags:
rat remcos keylogger
Link:
https://app.any.run/tasks/c0d84ced-1e43-4805-b13f-8fde742f7dd7

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Remcos
Create hunting rule
Link:
https://www.capesandbox.com/analysis/196162/
Detection(s):
Win.Trojan.Remcos-9753190-0
Create hunting rule

Win.Trojan.Remcos-9841897-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Setting a keyboard event handler
Creating a file in the %AppData% subdirectories
Connection attempt to an infection source
DNS request
Connection attempt
Query of malicious DNS domain
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
67%
Tags:
packed remcos
Link:
https://www.filescan.io/uploads/61603ef8e3d213d202bb95bc/reports/0228afac-e843-4de3-a6ad-baba30da67a1/overview
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/867093
Signature
Antivirus / Scanner detection for submitted sample
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Delayed program exit found
Detected Remcos RAT
Found malware configuration
Installs a global keyboard hook
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Download SVG
Detection:
remcos
Create hunting rule
Link:
https://mwdb.cert.pl/sample/bd0baa9f0e69f70c827e05b8bae5a4b34f04b21be971c39e3831d584140d08d3/
Threat name:
Win32.Backdoor.Remcos
Create hunting rule
Status:
Malicious
First seen:
2021-09-09 02:10:00 UTC
AV detection:
38 of 45 (84.44%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xuf2vhyonh3qzat6aw4lvznewnhqjmq35fy4hhryghkyifanbdjq._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
5000f900d0d52fb1b6634d0437711ab10c9184d080c852f17b2fb114a35446a8
RemcosRAT
77ce24c903d75a340e3d5664091c7b72a2529640931e662b80b8dc3fb9226929
RemcosRAT
8378cff1c00e9259db81de361f9e5ebfc5eb1e932c0d21c5b003360c46a7eb43
RemcosRAT
860e16c192167d5dd823b8e533858cdada7aa9b3173254f2f57031af68b84e0c
RemcosRAT
87284733f84447db5f12697e7ce2fb44671cbf404e040cf85085b223eab02b95
RemcosRAT
993528adce97be31c6c1e1c01f4877f229b10e8f06b87d8cbcc2f95b46866872
RemcosRAT
a3faa214333ce59ed895410e011c4cbd44fe51b26ed5bf2a0ed54e225616f893
RemcosRAT
af9fa73ff6907f77d55aac6376f3f2e73160fc97afec3656e77da8d5e0a6a488
RemcosRAT
bfd45ef21e21655c921b457242c1d4e05a1e979d0051a4195192d8e17b7bed38
RemcosRAT
d83290b80bf412884168a6d24a06fad12edb578cc612ea555476b422a4499613
RemcosRAT
+ 697 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:all rat
Link:
https://tria.ge/reports/211008-p343paedcq/
Behaviour
Suspicious use of SetWindowsHookEx
Remcos
Malware Config
C2 Extraction:
Officialsw.chickenkiller.com:2310
official.ydns.eu:2310
hurricane.ydns.eu:2310
Unpacked files
SH256 hash:
bd0baa9f0e69f70c827e05b8bae5a4b34f04b21be971c39e3831d584140d08d3
MD5 hash:
12cfdbcb62a3ec5f9de2c5c2efc759d5
SHA1 hash:
478d77fe1dcba768fbb30f8c845349dd0ffa1d32
Detections:
win_remcos_g0
Create hunting rule
Link:
https://www.unpac.me/results/53a0aa52-83c3-4e11-882d-752cd0cb06e7/
Malware family:
Remcos
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/bd0baa9f0e69/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Remcos
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/bd0baa9f0e69f70c827e05b8bae5a4b34f04b21be971c39e3831d584140d08d3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_RemcosRAT
Create hunting rule
Author:abuse.ch
Rule name:INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer
Create hunting rule
Author:ditekSHen
Description:detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Rule name:Remcos
Create hunting rule
Author:kevoreilly
Description:Remcos Payload
Rule name:remcos_rat
Create hunting rule
Author:jeFF0Falltrades
Rule name:REMCOS_RAT_variants
Create hunting rule
Rule name:REMCOS_RAT_variants
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/196162/

Comments