🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c4a9ef7db9783334e07106fb671d5e27e52285b18182a8c77103b699c8edf8a0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 8


Intelligence 8 IOCs YARA 11 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c4a9ef7db9783334e07106fb671d5e27e52285b18182a8c77103b699c8edf8a0
SHA3-384 hash: 5b97bb5e8dfedf89490137b63822a5309946e00032138efd8923d72f59af51e553a5581c34752be692faa848a42f374e
SHA1 hash: b8d8c459aa6d28ad662b827d4824504a17713d7b
MD5 hash: f3f57458e239713f9c8456a26300b5e2
humanhash: echo-kansas-november-cardinal
File name:RFQ_18100000418350098.cmd
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:3'217'712 bytes
First seen:2024-06-12 13:47:09 UTC
Last seen:Never
File type:cmd cmd
MIME type:text/plain
ssdeep 49152:9MUbtVEmXHn8PdIb70PyA1nMreGigEb0S9l0/Z0/SPjryq0OPez5c:h
TLSH T1C6E530A33DAD068EE70D639B978F9C1C0A17DC2B06D2EDC44FF62589753926B18809DD
Reporter ghvbn
Tags:cmd DBatLoader remcos RemcosRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
147
Origin country :
DE DE
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Other.Malware-gen.27735.20659.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
90.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=666a7b98a2bce47be7d80ee5win7simulatehigh_evasion
Tags:
Encryption Execution Network Generic
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
masquerade
Link:
https://www.filescan.io/uploads/6669a71eea679c2da9183f52/reports/467acef7-6440-4972-8995-0223f420c093/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/c4a9ef7db9783334e07106fb671d5e27e52285b18182a8c77103b699c8edf8a0
Result
Threat name:
DBatLoader
Create hunting rule
Detection:
malicious
Classification:
bank.troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1456349
Signature
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Contains functionality to detect sleep reduction / modifications
Drops or copies certutil.exe with a different name (likely to bypass HIPS)
Drops or copies cmd.exe with a different name (likely to bypass HIPS)
Drops PE files to the user root directory
Drops PE files with a suspicious file extension
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Machine Learning detection for dropped file
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Registers a new ROOT certificate
Sigma detected: Execution from Suspicious Folder
Sigma detected: Parent in Public Folder Suspicious Process
Sigma detected: Suspicious Program Location with Network Connections
Yara detected DBatLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1456349 Sample: RFQ_18100000418350098.cmd Startdate: 13/06/2024 Architecture: WINDOWS Score: 100 37 cinnamonthai.com 2->37 41 Multi AV Scanner detection for submitted file 2->41 43 Yara detected DBatLoader 2->43 45 Sigma detected: Suspicious Program Location with Network Connections 2->45 47 2 other signatures 2->47 8 cmd.exe 1 2->8         started        signatures3 process4 process5 10 Audio.pif 8->10         started        14 extrac32.exe 1 8->14         started        17 alpha.exe 1 8->17         started        19 5 other processes 8->19 dnsIp6 39 cinnamonthai.com 203.78.107.130, 443, 49755, 49756 NETWAY-AS-APNetwayCommunicationCoLtdTH Thailand 10->39 53 Multi AV Scanner detection for dropped file 10->53 55 Machine Learning detection for dropped file 10->55 57 Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors) 10->57 65 2 other signatures 10->65 21 WerFault.exe 16 10->21         started        35 C:\Users\Public\alpha.exe, PE32+ 14->35 dropped 59 Drops PE files to the user root directory 14->59 61 Drops or copies certutil.exe with a different name (likely to bypass HIPS) 14->61 63 Drops or copies cmd.exe with a different name (likely to bypass HIPS) 14->63 23 kn.exe 3 2 17->23         started        26 kn.exe 2 19->26         started        29 extrac32.exe 1 19->29         started        file7 signatures8 process9 file10 49 Registers a new ROOT certificate 23->49 51 Drops PE files with a suspicious file extension 23->51 31 C:\Users\Public\Libraries\Audio.pif, PE32 26->31 dropped 33 C:\Users\Public\kn.exe, PE32+ 29->33 dropped signatures11
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/c4a9ef7db9783334e07106fb671d5e27e52285b18182a8c77103b699c8edf8a0
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c4a9ef7db9783334e07106fb671d5e27e52285b18182a8c77103b699c8edf8a0/
Threat name:
Script-BAT.Trojan.Remcos
Create hunting rule
Status:
Malicious
First seen:
2024-06-04 16:43:18 UTC
File Type:
Text
AV detection:
13 of 36 (36.11%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ysu667nzpaztjydra35wohk6e7ssfbnrqgbkrr3rao3jtshn7cqa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
DBatLoader
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c4a9ef7db9783334e07106fb671d5e27e52285b18182a8c77103b699c8edf8a0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__RemoteAPI
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:maldoc_getEIP_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:without_attachments
Create hunting rule
Author:Antonio Sanchez <asanchez@hispasec.com>
Description:Rule to detect the no presence of any attachment
Reference:http://laboratorio.blogs.hispasec.com/
Rule name:with_urls
Create hunting rule
Author:Antonio Sanchez <asanchez@hispasec.com>
Description:Rule to detect the presence of an or several urls
Reference:http://laboratorio.blogs.hispasec.com/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

cmd cmd c4a9ef7db9783334e07106fb671d5e27e52285b18182a8c77103b699c8edf8a0

(this sample)

  
Link
https://isc.sans.edu/diary/Malspam+pushes+ModiLoader+DBatLoader+infection+for+Remcos+RAT/29896
  
Delivery method
Distributed via e-mail attachment

Comments