MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c3f43d2f1e2f99cf22384cf00cfde5edadebd79e5d60bbaffee2cd5431fc0fab. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 13


Intelligence 13 IOCs YARA 12 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c3f43d2f1e2f99cf22384cf00cfde5edadebd79e5d60bbaffee2cd5431fc0fab
SHA3-384 hash: 1cc63f451f8ca1261ef07089a1023850e1acab2be2c8102bce94c930e31bf7a9a2bfe8335bdf755a8738a404e60a3bb4
SHA1 hash: 8eb23d1763f72c897fbc451fc4181dc70db05e06
MD5 hash: dcf69f752db09d36ffbdab412a3c83da
humanhash: fanta-hotel-chicken-vermont
File name:c3f43d2f1e2f99cf22384cf00cfde5edadebd79e5d60bbaffee2cd5431fc0fab
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:2'969'088 bytes
First seen:2023-04-04 12:42:38 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'608 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 24576:Qny0sH+gpQTlVYtlfKtu1Dze6HDpLXFR49+EQIQxmjYXpSt0NCzPOvAjo06BFeCC:O+tla0EQ3+pNITIVREXunHBlZJGd6j
Threatray 1'796 similar samples on MalwareBazaar
TLSH T133D56BB122E2FE85E37F1E70C01425404C60682BA2BCD75DBEC965D61BE1B64DF8C6B6
TrID 60.4% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.8% (.SCR) Windows screen saver (13097/50/3)
8.7% (.EXE) Win64 Executable (generic) (10523/12/4)
5.4% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
Reporter adrian__luca
Tags:exe RemcosRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
264
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
c3f43d2f1e2f99cf22384cf00cfde5edadebd79e5d60bbaffee2cd5431fc0fab
Verdict:
No threats detected
Analysis date:
2023-04-04 12:40:58 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/a79f1e97-1617-4909-baac-caaf9ecf5aee

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Remcos
Create hunting rule
Link:
https://www.capesandbox.com/analysis/380014/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.66120672.25989.988.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Launching a process
Creating a process with a hidden window
Creating a file in the %AppData% subdirectories
Unauthorized injection to a recently created process
Creating a file
Setting a keyboard event handler
DNS request
Sending a custom TCP request
Sending an HTTP GET request
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/642c1b57497fb6f23efd52e2/reports/bcaf87e5-1aee-454d-9938-958c2f33b113/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/c3f43d2f1e2f99cf22384cf00cfde5edadebd79e5d60bbaffee2cd5431fc0fab
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/cd03aaee-0c9b-4198-832b-86c98da3a5da
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1208267
Signature
.NET source code contains potential unpacker
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Encrypted powershell cmdline option found
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Remcos
Uses dynamic DNS services
Yara detected Generic Downloader
Yara detected Remcos RAT
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 841188 Sample: 1OSgM48KMg.exe Startdate: 04/04/2023 Architecture: WINDOWS Score: 100 48 Malicious sample detected (through community Yara rule) 2->48 50 Antivirus detection for URL or domain 2->50 52 Multi AV Scanner detection for dropped file 2->52 54 11 other signatures 2->54 7 1OSgM48KMg.exe 1 7 2->7         started        11 Gavjogb.exe 4 2->11         started        13 Gavjogb.exe 3 2->13         started        process3 file4 36 C:\Users\user\AppData\Roaming\...behaviorgraphavjogb.exe, PE32 7->36 dropped 38 C:\Users\user\...behaviorgraphavjogb.exe:Zone.Identifier, ASCII 7->38 dropped 40 C:\Users\user\AppData\...\1OSgM48KMg.exe.log, ASCII 7->40 dropped 56 Encrypted powershell cmdline option found 7->56 58 Injects a PE file into a foreign processes 7->58 15 1OSgM48KMg.exe 2 17 7->15         started        20 powershell.exe 16 7->20         started        22 powershell.exe 11 11->22         started        24 Gavjogb.exe 11->24         started        26 powershell.exe 13->26         started        signatures5 process6 dnsIp7 42 forwarding2023.ddns.net 185.225.73.58, 18114, 49683 MAYAKBG Germany 15->42 44 geoplugin.net 178.237.33.50, 49684, 80 ATOM86-ASATOM86NL Netherlands 15->44 34 C:\ProgramData\remcos\logs.dat, data 15->34 dropped 46 Installs a global keyboard hook 15->46 28 conhost.exe 20->28         started        30 conhost.exe 22->30         started        32 conhost.exe 26->32         started        file8 signatures9 process10
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c3f43d2f1e2f99cf22384cf00cfde5edadebd79e5d60bbaffee2cd5431fc0fab/
Threat name:
Win32.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2023-03-27 03:41:33 UTC
File Type:
PE (.Net Exe)
Extracted files:
5
AV detection:
24 of 37 (64.86%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=yp2d2ly6f6m46iryjtyaz7pf5ww6xv46lvqlxl764lgvimp4b6vq._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
02ced6da9cf24901681948deae308d36975cb623dcc6735f2142f4252bc7e197
RemcosRAT
0c10e1c8152eb2a30a9270ef79401b905e42bb6706d71094b59dd46502336f8e
RemcosRAT
16a1100ab0af5497ee45778f1a516357b3bae96797c9417d2e028a31ebe2bf80
RemcosRAT
1d0a51787f8726c44aa40f88422d01f084c4e533c2f190f4aef1696f9fd600d9
RemcosRAT
4bfea5eeb97d0ca4f3f2edd8114048e9a14f43f89187c55f29f2142cdef8da9a
RemcosRAT
881b9954a4f1debc7e45fecb6072f05daa542c368af208156fd624d5b5fabc95
RemcosRAT
c3653e6517e48603a356a5978cdc1b210bd20e023146fd561c611c3b82c0736c
RemcosRAT
+ 1'786 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:remotehost ky persistence rat
Link:
https://tria.ge/reports/230404-pxw5wsgg81/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Checks computer location settings
Remcos
Malware Config
C2 Extraction:
forwarding2023.ddns.net:18114
Unpacked files
SH256 hash:
c3f43d2f1e2f99cf22384cf00cfde5edadebd79e5d60bbaffee2cd5431fc0fab
MD5 hash:
dcf69f752db09d36ffbdab412a3c83da
SHA1 hash:
8eb23d1763f72c897fbc451fc4181dc70db05e06
Link:
https://www.unpac.me/results/e32e82c2-7f4e-4cca-9229-e668bdf62d32/
Malware family:
Remcos
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/c3f43d2f1e2f/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Remcos
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/c3f43d2f1e2f99cf22384cf00cfde5edadebd79e5d60bbaffee2cd5431fc0fab

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:iexplorer_remcos
Create hunting rule
Author:iam-py-test
Description:Detect iexplorer being taken over by Remcos
Rule name:INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
Create hunting rule
Author:ditekSHen
Description:Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Rule name:pe_imphash
Create hunting rule
Rule name:Remcos
Create hunting rule
Author:kevoreilly
Description:Remcos Payload
Rule name:REMCOS_RAT_variants
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Suspicious_Macro_Presence
Create hunting rule
Author:Mehmet Ali Kerimoglu (CYB3RMX)
Description:This rule detects common malicious/suspicious implementations.
Rule name:Windows_Trojan_Remcos_b296e965
Create hunting rule
Author:Elastic Security
Rule name:win_remcos_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.remcos.
Rule name:XWorm_Hunter
Create hunting rule
Author:Potato

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/380014/

Comments