MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c54b1a3af48ef7f70434b9e90c33b4bcdccfbd20339d8164e34957890c67f888. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 5


Intelligence 5 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c54b1a3af48ef7f70434b9e90c33b4bcdccfbd20339d8164e34957890c67f888
SHA3-384 hash: e4727e95c11d7fa6c0f57ffdc168df2bbc8679bc160a92ac24e51802b58df3caff5692b672bb29959a6a3fb4cb90901c
SHA1 hash: 044ceea8b2fb554e2fdd7bcf4d695dded3a58d3b
MD5 hash: b30b9c1d23026ff24f234a07a557dc83
humanhash: steak-grey-sierra-kansas
File name:b30b9c1d23026ff24f234a07a557dc83.exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:184'320 bytes
First seen:2021-09-27 12:31:11 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 831c9926df4754b736e1ca092f4fb7e7 (5 x RemcosRAT, 1 x GuLoader)
ssdeep 3072:aTN6q3h21LWcznBUcxYIBpafjJJUB/yu0d/eWjUUqdj/WHA:aTyttVBwbbGyjeWjp
Threatray 5'679 similar samples on MalwareBazaar
TLSH T1FD04C6456E78A82CE1C53DB4B875A49913CA3C03EB8552AE10D4F3FC7774AED6812B27
File icon (PE):PE icon
dhash icon 1003873d31213f10 (142 x DarkCloud, 132 x GuLoader, 35 x a310Logger)
Reporter abuse_ch
Tags:exe RemcosRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
130
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
b30b9c1d23026ff24f234a07a557dc83.exe
Verdict:
Suspicious activity
Analysis date:
2021-09-27 12:36:22 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/e3e56868-c3ea-4fe8-bfec-23fd8f6f3b6f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/192076/
Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/3a3babbe-d74f-4c95-81f2-9a4bc9ce1e7c
Result
Threat name:
GuLoader Remcos
Create hunting rule
Detection:
malicious
Classification:
rans.troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/858966
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
GuLoader behavior detected
Hides threads from debuggers
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Potential malicious icon found
Tries to detect Any.run
Uses dynamic DNS services
Yara detected GuLoader
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c54b1a3af48ef7f70434b9e90c33b4bcdccfbd20339d8164e34957890c67f888/
Threat name:
Win32.Trojan.Mucc
Create hunting rule
Status:
Malicious
First seen:
2021-09-27 13:02:38 UTC
AV detection:
11 of 28 (39.29%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
137429f8f6983a033eb1ed755a5da8ac1ae8ff759eeb1df3ed534e2dd4e6082e
RemcosRAT
15520c752a3375cd92bee021404e10830d4732681be2e50b3d293bcbd3c1e262
RemcosRAT
1c0d93b0cf7a58a0cc6431c0aa5da4a88cbb9522c616006c30c747bd306da191
RemcosRAT
239629ce61bd284521557512f4781f72e7b8bdd56a8691845dc180ffc77b5252
RemcosRAT
5b638cf8104db2f27a5e66e77376a493e18403f4be26bd9f005a1551b173761b
RemcosRAT
75591cb23ef20e0a1bc8d01a392621d608b83ee25bcf37b330d3e966d2c8a50b
RemcosRAT
8653a11ee811265418a3b6f12945c585b77aea72f02b2d80f481c1100d895299
RemcosRAT
c3ca97abe1f0584928691bf13d02b25a4e20288a2477e466d67000c0bbe04df3
RemcosRAT
db48dc160b1f48b8939b0d49c5f0bee2a28bc3b340cff62cea8da50424e1afea
RemcosRAT
f8c32c700279f87b3956631cc6567e746afed535006a45f0839d4d346db8ad00
RemcosRAT
+ 5'669 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:guloader family:remcos downloader rat
Link:
https://tria.ge/reports/210927-pqmymshaa2/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Checks QEMU agent file
Guloader,Cloudeye
Remcos
Unpacked files
SH256 hash:
49b04162c412105ab0857de16713724cbf3234a0b6ba51f3a5286312633f20c3
MD5 hash:
1f1b425190b2fb0396ad2d538b1060ba
SHA1 hash:
413f98641d46fdcabfcaf64f29495667de6282ea
Link:
https://www.unpac.me/results/8ff8d041-6b2f-43eb-a87a-5ce7c8d80b24/
SH256 hash:
c54b1a3af48ef7f70434b9e90c33b4bcdccfbd20339d8164e34957890c67f888
MD5 hash:
b30b9c1d23026ff24f234a07a557dc83
SHA1 hash:
044ceea8b2fb554e2fdd7bcf4d695dded3a58d3b
Link:
https://www.unpac.me/results/8ff8d041-6b2f-43eb-a87a-5ce7c8d80b24/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/c54b1a3af48ef7f70434b9e90c33b4bcdccfbd20339d8164e34957890c67f888

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:quakbot_halo_generated
Create hunting rule
Author:Halogen Generated Rule, Corsin Camichel
Rule name:silentbuilder_halo_generated
Create hunting rule
Author:Halogen Generated Rule, Corsin Camichel

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RemcosRAT

Executable exe c54b1a3af48ef7f70434b9e90c33b4bcdccfbd20339d8164e34957890c67f888

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1597372/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/192076/

Comments