MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c751eef24ba7492781e43c5034f1175ec098ebc72602e68822fd4c09cac0b9bb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemcosRAT

Vendor detections: 19

Intelligence 19 IOCs YARA 8 File information Comments 1

SHA256 hash:	c751eef24ba7492781e43c5034f1175ec098ebc72602e68822fd4c09cac0b9bb
SHA3-384 hash:	fc0f3c43c68698736b808e8cc72f892bba40ca86c5cbefaf324fb4d95c39036008ee4ec95fd5c186dd960f97868c0d96
SHA1 hash:	d436d44c5a23a2450cf37012f16e0833d94be256
MD5 hash:	6679fc3ab44e5e9ff3abe5445d3fc09d
humanhash:	arizona-maryland-emma-montana
File name:	6679fc3ab44e5e9ff3abe5445d3fc09d
Download:	download sample
Signature	RemcosRAT Create hunting rule
File size:	480'768 bytes
First seen:	2022-09-16 08:13:56 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	5d354883fe6f15fcf48045037a99fb7a (118 x RemcosRAT)
ssdeep	12288:Wmnk7iLJbpIpiRL6I2WhSKQ9ZsfZQSUn9:uiLJbpI7I2WhQqZ7U9
TLSH	T1BAA4AE02BAD2C072D57161344D2AE775DABDBC202835997BB3E61D5BFD30180A73A7B2
TrID	32.2% (.EXE) Win64 Executable (generic) (10523/12/4) 20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 15.4% (.EXE) Win16 NE executable (generic) (5038/12/1) 13.7% (.EXE) Win32 Executable (generic) (4505/5/1) 6.2% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):
dhash icon	c4d48eaa8ad4d4f8 (1'000 x RemcosRAT, 1 x Worm.Ramnit, 1 x Vjw0rm)
Reporter	zbetcheckin
Tags:	32 exe RemcosRAT

Intelligence

File Origin

# of uploads :

# of downloads :

296

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

redline

ID:

File name:

http://81.161.229.110/htdocs/

Verdict:

Malicious activity

Analysis date:

2022-09-15 10:26:27 UTC

Tags:

opendir loader keylogger trojan rat redline remcos stealer avemaria nanocore arkei warzone evasion quasar agenttesla

Link:

https://app.any.run/tasks/0a842668-3faf-4537-92e9-cefbdaa63612

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Remcos

Link:

https://www.capesandbox.com/analysis/310483/

Detection(s):

Win.Trojan.Remcos-9841897-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Setting a keyboard event handler

Launching a process

Creating a file

Unauthorized injection to a system process

Result

Malware family:

n/a

Score:

6/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/37843/overview

Behaviour

MalwareBazaar

MeasuringTime

EvasionQueryPerformanceCounter

CheckCmdLine

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

cmd.exe eventvwr.exe fingerprint greyware keylogger rat shell32.dll

Link:

https://www.filescan.io/uploads/6324309f1183046074a67a2a/reports/dfad9598-8456-4f20-9b8c-47c48d38f6f3/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

REMCOS

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/5e441914-dcfa-4b66-a69e-2a91dbcd83b9

Result

Threat name:

Remcos

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1071483

Signature

Antivirus / Scanner detection for submitted sample

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Contains functionality to steal Chrome passwords or cookies

Delayed program exit found

Found evasive API chain (may stop execution after checking mutex)

Found stalling execution ending in API Sleep call

Installs a global keyboard hook

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Multi AV Scanner detection for submitted file

Writes to foreign memory regions

Yara detected Remcos RAT

Behaviour

Behavior Graph:

Download SVG

Detection:

remcos

Link:

https://mwdb.cert.pl/sample/c751eef24ba7492781e43c5034f1175ec098ebc72602e68822fd4c09cac0b9bb/

Threat name:

Win32.Backdoor.Remcos

Status:

Malicious

First seen:

2022-09-15 14:30:31 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

33 of 38 (86.84%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=y5i654slu5espapehridj4ixl3ajr26heyboncbc7vgatswaxg5q._file

Verdict:

malicious

Label(s):

remcos

Result

Malware family:

remcos

Score:

10/10

Tags:

family:remcos botnet:win 4 rat

Link:

https://tria.ge/reports/220916-j4zlpsaggn/

Behaviour

Suspicious behavior: MapViewOfSection

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Remcos

Malware Config

C2 Extraction:

51.210.137.26:2404
51.210.137.26:5656

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/117f1c0c-cd9a-439b-9b75-cde76a905350

Unpacked files

SH256 hash:

c751eef24ba7492781e43c5034f1175ec098ebc72602e68822fd4c09cac0b9bb

MD5 hash:

6679fc3ab44e5e9ff3abe5445d3fc09d

SHA1 hash:

d436d44c5a23a2450cf37012f16e0833d94be256

Detections:

win_remcos_auto

Link:

https://www.unpac.me/results/da7c4e6d-31b1-4ac8-bb96-9929a62c7f3c/

Malware family:

Remcos

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/c751eef24ba7/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/c751eef24ba7492781e43c5034f1175ec098ebc72602e68822fd4c09cac0b9bb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer Create hunting rule
Author:	ditekSHen
Description:	detects Windows exceutables potentially bypassing UAC using eventvwr.exe

Rule name:	RansomwareTest4 Create hunting rule
Author:	Daoyuan Wu
Description:	Test Ransomware YARA rules

Rule name:	RansomwareTest5 Create hunting rule
Author:	Daoyuan Wu
Description:	Test Ransomware YARA rules

Rule name:	RansomwareTest6 Create hunting rule
Author:	Daoyuan Wu
Description:	Test Ransomware YARA rules

Rule name:	Record_Breaker_Similarities Create hunting rule
Author:	DigitalPanda

Rule name:	Remcos Create hunting rule
Author:	kevoreilly
Description:	Remcos Payload

Rule name:	REMCOS_RAT_variants Create hunting rule

Rule name:	win_remcos_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	Detects win.remcos.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RemcosRAT

exe c751eef24ba7492781e43c5034f1175ec098ebc72602e68822fd4c09cac0b9bb

(this sample)

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/2305005/

Cape

https://www.capesandbox.com/analysis/310483/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

zbet commented on 2022-09-16 08:13:59 UTC

url : hxxp://81.161.229.110/htdocs/xMZGzWLKoaYNNCy.exe