MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c1a155ea8051e4e8af694595085b4562aa0c3ff48f89d3cb043f6d4b4e8bb54f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemcosRAT

Vendor detections: 17

Intelligence 17 IOCs YARA 1 File information Comments 1

SHA256 hash:	c1a155ea8051e4e8af694595085b4562aa0c3ff48f89d3cb043f6d4b4e8bb54f
SHA3-384 hash:	a8c98c708589112b1a43b3cd63761c53921700cfdc4281e2d4d8b64064cb5b2c39b2d81b6e85d2623a93e2f44d0fd917
SHA1 hash:	67ea7a6605c4e52f9f32c21207d050309bdaa2dc
MD5 hash:	859f5ba01acb6e8183db471ce9dd1ba9
humanhash:	alanine-illinois-kitten-carpet
File name:	859f5ba01acb6e8183db471ce9dd1ba9
Download:	download sample
Signature	RemcosRAT Create hunting rule
File size:	527'360 bytes
First seen:	2023-06-08 07:47:04 UTC
Last seen:	2023-06-08 09:24:35 UTC
File type:	exe
MIME type:	application/x-dosexec
ssdeep	12288:kiBKXNtqhbdE3Gkk4bUbPraTgZSi4XU7CqVUIJI:Jht4grraU6XP
TLSH	T16DB4F19D364032EFC867D4B2DDA41D69EA60797A871B4103E0271AEEED0D98BDF510F2
TrID	44.4% (.EXE) Win64 Executable (generic) (10523/12/4) 21.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 8.7% (.ICL) Windows Icons Library (generic) (2059/9) 8.5% (.EXE) OS/2 Executable (generic) (2029/13) 8.4% (.EXE) Generic Win/DOS Executable (2002/3)
Reporter	zbetcheckin
Tags:	64 exe RemcosRAT

Intelligence

File Origin

# of uploads :

# of downloads :

290

Origin country :

Vendor Threat Intelligence

Malware family:

remcos

ID:

File name:

859f5ba01acb6e8183db471ce9dd1ba9

Verdict:

Malicious activity

Analysis date:

2023-06-08 07:47:56 UTC

Tags:

remcos

Link:

https://app.any.run/tasks/656f2d0c-f85e-462a-9a41-c18b71f3305b

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Remcos

Link:

https://www.capesandbox.com/analysis/396812/

Detection(s):

PUA.Win.Packed.ConfuserEx-6391397-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Launching a process

Creating a file

Сreating synchronization primitives

DNS request

Sending a custom TCP request

Sending an HTTP GET request

Unauthorized injection to a system process

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

confuserex packed packed

Link:

https://www.filescan.io/uploads/648187b3ac63cac41b535c2d/reports/06ae5922-5695-40d0-875d-c65cd787e091/overview

Verdict:

Malicious

Labled as:

Tedy.Generic

Link:

https://www.hybrid-analysis.com/sample/c1a155ea8051e4e8af694595085b4562aa0c3ff48f89d3cb043f6d4b4e8bb54f

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

REMCOS

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/e8c64c2e-6b7b-4940-92d0-210f3313fb68

Result

Threat name:

Remcos

Detection:

malicious

Classification:

troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1250963

Signature

Allocates memory in foreign processes

Antivirus / Scanner detection for submitted sample

C2 URLs / IPs found in malware configuration

Connects to many ports of the same IP (likely port scanning)

Contains functionality to bypass UAC (CMSTPLUA)

Contains functionality to modify clipboard data

Contains functionality to steal Chrome passwords or cookies

Contains functionality to steal Firefox passwords or cookies

Delayed program exit found

Found malware configuration

Injects a PE file into a foreign processes

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

PE file contains section with special chars

Sigma detected: Remcos

Uses dynamic DNS services

Writes to foreign memory regions

Yara detected Remcos RAT

Yara detected UAC Bypass using CMSTP

Behaviour

Behavior Graph:

Download SVG

Detection:

remcos

Link:

https://mwdb.cert.pl/sample/c1a155ea8051e4e8af694595085b4562aa0c3ff48f89d3cb043f6d4b4e8bb54f/

Threat name:

Win64.Trojan.Remcos

Status:

Malicious

First seen:

2023-06-08 06:52:16 UTC

File Type:

PE+ (.Net Exe)

Extracted files:

AV detection:

22 of 37 (59.46%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ygqvl2uakhsorl3jiwkqqw2fmkvayp7ur6e5hsyeh5wuwtulwvhq._file

Verdict:

malicious

Result

Malware family:

remcos

Score:

10/10

Tags:

family:remcos botnet:remotehost rat

Link:

https://tria.ge/reports/230608-jm4jbsdb47/

Behaviour

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Remcos

Malware Config

C2 Extraction:

pekonomiana.duckdns.org:30491

Unpacked files

SH256 hash:

c1a155ea8051e4e8af694595085b4562aa0c3ff48f89d3cb043f6d4b4e8bb54f

MD5 hash:

859f5ba01acb6e8183db471ce9dd1ba9

SHA1 hash:

67ea7a6605c4e52f9f32c21207d050309bdaa2dc

Link:

https://www.unpac.me/results/804f8027-22de-4466-8ec7-2c03c97f8794/

Malware family:

Remcos

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/c1a155ea8051/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

AlphaCrypt

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/c1a155ea8051e4e8af694595085b4562aa0c3ff48f89d3cb043f6d4b4e8bb54f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.