MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 c14657190bec0bf6b8fd9ef47563657948aa3ea66a43e7d0224c7662f323e144. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
RemcosRAT
Vendor detections: 15
| SHA256 hash: | c14657190bec0bf6b8fd9ef47563657948aa3ea66a43e7d0224c7662f323e144 |
|---|---|
| SHA3-384 hash: | 70a7f385b45d647bed420030d5161fc764b7a71db3eb832b0e27e3a0dfb183a484ce59c2eba8804877dd2b4c6aa78a8e |
| SHA1 hash: | 416439f73d6c381570b189ec13e39e75dbfa0124 |
| MD5 hash: | a2e86c66aeb9972f4d321bc8c09f6462 |
| humanhash: | stairway-charlie-indigo-avocado |
| File name: | a2e86c66aeb9972f4d321bc8c09f6462 |
| Download: | download sample |
| Signature | RemcosRAT |
| File size: | 1'218'048 bytes |
| First seen: | 2023-08-03 05:50:28 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'599 x Formbook, 12'241 x SnakeKeylogger) |
| ssdeep | 24576:WWo3JwEUGlbYnEjkb8nZ0Co0z05+56/y:po5wEUGBYEUsA0kF |
| Threatray | 2'479 similar samples on MalwareBazaar |
| TLSH | T14A455B3804B80A12C135D2AD9AD4F613B3904F96761DCD5686C24FC90AD6E2F2DDBDEE |
| TrID | 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10523/12/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4505/5/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9) |
| Reporter |  zbetcheckin |
| Tags: | 32 exe RemcosRAT |
Intelligence
File Origin
# of uploads :
1
# of downloads :
281
Origin country :
FRVendor Threat Intelligence
Malware family:
remcos
ID:
1
File name:
PO.No.660240685.doc
Verdict:
Malicious activity
Analysis date:
2023-08-03 03:06:09 UTC
Tags:
exploit cve-2017-11882 loader rat remcos remote keylogger
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Remcos
Result
Verdict:
Clean
Maliciousness:
Behaviour
Creating a window
Restart of the analyzed sample
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
packed
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
REMCOS
Verdict:
Malicious
Result
Threat name:
Remcos
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Signature
.NET source code contains potential unpacker
.NET source code contains very large strings
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to bypass UAC (CMSTPLUA)
Contains functionality to modify clipboard data
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Delayed program exit found
Found malware configuration
Installs a global keyboard hook
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Sigma detected: Remcos
Yara detected Remcos RAT
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Detection:
remcos
Threat name:
ByteCode-MSIL.Trojan.FormBook
Status:
Malicious
First seen:
2023-08-03 03:58:50 UTC
File Type:
PE (.Net Exe)
Extracted files:
14
AV detection:
19 of 38 (50.00%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
remcos
Similar samples:
+ 2'469 additional samples on MalwareBazaar
Result
Malware family:
remcos
Score:
10/10
Tags:
family:remcos botnet:thcinc rat
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Remcos
Malware Config
C2 Extraction:
b6079658.sytes.net:6110
Unpacked files
SH256 hash:
53f2ad060cf771aa4f197df5789cee95959480c244a0b392bb450c8ce7311d77
MD5 hash:
37e82d3e2864e27b34f5fbacaea759c3
SHA1 hash:
a87024a466e052bff09a170bb8c6f374f6c84c32
SH256 hash:
b466ce8c2711f7403d393d41c5a4b44a5e49b82144112865c0f01ca0b5ec5513
MD5 hash:
97b35509d998bebdd69bb4e6d57bc989
SHA1 hash:
715e4c0d34d9748e7f41f81065a51270cc7ff064
SH256 hash:
5b2b7aa12e065130ce1b14c34ce0bdd435e120416b75f383e09f77efed5f463e
MD5 hash:
73b66329882a8bd0360bb441591b0d30
SHA1 hash:
58232deb7af0f26e35816927d12ec2441443631d
Detections:
Remcos
win_remcos_auto
Parent samples :
c14657190bec0bf6b8fd9ef47563657948aa3ea66a43e7d0224c7662f323e144
75e57d3f76491b9bc7fe155b20ea8f9498892bd54a34824fca50bf0ae4a1902e
920fae943bbfb6cb7dd1a1a13e6abfb6f951ed79eaa01b9b693ff6a8224ae1e1
ff450b9ba2302dbefa84542c8818a0c233b303c126c2c01aee019c7fbf6340b8
dfe0f95ffc9ad74d75e0c2089a34fd96594e47b9c635eb5c884cec8f1d20ef0a
8aae048958f1eb9e76e5b01174d4055763e4af720d0b48c4e2741ee7da3bc222
0fe9312c5237b767dc07de6296a5a7aaf8b7c7ec4540f1c65f158aba5079a283
26cae4cdeef032aea2bd4ea1c5b88fbfb876bb3dd35a54076356195969fe3611
e6efc87407a88a82189a7fe864eff162fd8feb0d09fcb58f18655c758e7a0600
75e57d3f76491b9bc7fe155b20ea8f9498892bd54a34824fca50bf0ae4a1902e
920fae943bbfb6cb7dd1a1a13e6abfb6f951ed79eaa01b9b693ff6a8224ae1e1
ff450b9ba2302dbefa84542c8818a0c233b303c126c2c01aee019c7fbf6340b8
dfe0f95ffc9ad74d75e0c2089a34fd96594e47b9c635eb5c884cec8f1d20ef0a
8aae048958f1eb9e76e5b01174d4055763e4af720d0b48c4e2741ee7da3bc222
0fe9312c5237b767dc07de6296a5a7aaf8b7c7ec4540f1c65f158aba5079a283
26cae4cdeef032aea2bd4ea1c5b88fbfb876bb3dd35a54076356195969fe3611
e6efc87407a88a82189a7fe864eff162fd8feb0d09fcb58f18655c758e7a0600
SH256 hash:
40821038dd9a8a0c85f1c5898dcdd8fac1499e0b569ddfbadffe1c6ceb0aa03b
MD5 hash:
71ff3a9613b8d58debedc2742c43def3
SHA1 hash:
17cc80f177b9baa3f97024e6c7606961aaf36e37
SH256 hash:
c14657190bec0bf6b8fd9ef47563657948aa3ea66a43e7d0224c7662f323e144
MD5 hash:
a2e86c66aeb9972f4d321bc8c09f6462
SHA1 hash:
416439f73d6c381570b189ec13e39e75dbfa0124
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.url : hxxp://2.59.254.18/_errorpages/plugmanzx.exe