MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c9e1a99f3dc25db820f2737d26e80b2dc0a5f8be6ce07b7e92738cd010a18417. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 15


Intelligence 15 IOCs YARA 18 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c9e1a99f3dc25db820f2737d26e80b2dc0a5f8be6ce07b7e92738cd010a18417
SHA3-384 hash: c375502e822e71777dc898bfeb7614c107cf2f5a7687694c3cdc066f894858caf2ec20a02f72b18602617a5706f8e692
SHA1 hash: d033d2943c4732a5ca0fb16a681bea0225d2cb6e
MD5 hash: a909ef85d431ee3ab40693f2335eae8d
humanhash: alpha-don-oxygen-november
File name:PaymentNotification.pdf.exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:550'912 bytes
First seen:2023-01-17 11:10:32 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'662 x AgentTesla, 19'477 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:XzTk3tbYXTi6FWx0KCzIAxLNieFtteoEmaXUfZvRaUHDNKG:XE3tbu3/0SNieFtD7vlRaiD
Threatray 2'692 similar samples on MalwareBazaar
TLSH T155C4231432EDC459D1E519B78C1747180EB2973BDA82EA3EEAC0B0440AF3FD79B5536A
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):PE icon
dhash icon d2e8ecb2b2a2b282 (106 x AgentTesla, 106 x Formbook, 24 x RedLineStealer)
Reporter lowmal3
Tags:exe RemcosRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
236
Origin country :
DE DE
Vendor Threat Intelligence
Malware family:
remcos
Create hunting rule
ID:
1
File name:
PaymentNotification.pdf.exe
Verdict:
Malicious activity
Analysis date:
2023-01-17 11:13:01 UTC
Tags:
rat remcos stealer
Link:
https://app.any.run/tasks/31950d7c-7360-470d-b5f9-38f948ac28e7

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Remcos
Create hunting rule
Link:
https://www.capesandbox.com/analysis/353742/
Detection(s):
SecuriteInfo.com.Malware.PDB-71.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Creating a file
Сreating synchronization primitives
DNS request
Sending a custom TCP request
Sending an HTTP GET request
Reading critical registry keys
Creating a file in the %temp% directory
Stealing user critical data
Unauthorized injection to a system process
Verdict:
No Threat
Threat level:
  2/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/63c68247afdaca54d438c3f6/reports/2584d423-f50f-4a12-b49d-b5a8f5b46ad8/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
REMCOS
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4dafe8f6-df3a-42c1-803c-a0c114ecf3c1
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
spre.phis.troj.adwa.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1152979
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Delayed program exit found
Drops PE files to the startup folder
Initial sample is a PE file and has a suspicious name
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Powershell drops PE file
Sigma detected: Copy file to startup via Powershell
Sigma detected: Remcos
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file / registry access)
Uses an obfuscated file name to hide its real file extension (double extension)
Yara detected Remcos RAT
Yara detected WebBrowserPassView password recovery tool
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 785711 Sample: PaymentNotification.pdf.exe Startdate: 17/01/2023 Architecture: WINDOWS Score: 100 47 Malicious sample detected (through community Yara rule) 2->47 49 Antivirus detection for URL or domain 2->49 51 Antivirus detection for dropped file 2->51 53 12 other signatures 2->53 7 PaymentNotification.pdf.exe 1 2->7         started        process3 file4 29 C:\Users\...\PaymentNotification.pdf.exe.log, ASCII 7->29 dropped 10 RegSvcs.exe 2 14 7->10         started        14 powershell.exe 14 7->14         started        process5 dnsIp6 35 top.thekillforabuse1.xyz 195.178.120.12, 1068, 49709, 49710 HEXAGLOBE-ASFR unknown 10->35 37 geoplugin.net 178.237.33.50, 49711, 80 ATOM86-ASATOM86NL Netherlands 10->37 55 Performs DNS queries to domains with low reputation 10->55 57 Contains functionality to inject code into remote processes 10->57 59 Maps a DLL or memory area into another process 10->59 61 Delayed program exit found 10->61 17 RegSvcs.exe 1 10->17         started        20 RegSvcs.exe 1 10->20         started        22 RegSvcs.exe 1 10->22         started        26 28 other processes 10->26 31 C:\Users\user\AppData\...\Systbebem.exe, PE32 14->31 dropped 33 C:\Users\...\Systbebem.exe:Zone.Identifier, ASCII 14->33 dropped 63 Drops PE files to the startup folder 14->63 65 Powershell drops PE file 14->65 24 conhost.exe 14->24         started        file7 signatures8 process9 dnsIp10 41 Tries to steal Instant Messenger accounts or passwords 17->41 43 Tries to steal Mail credentials (via file / registry access) 17->43 39 192.168.2.1 unknown unknown 26->39 45 Tries to harvest and steal browser information (history, passwords, etc) 26->45 signatures11
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c9e1a99f3dc25db820f2737d26e80b2dc0a5f8be6ce07b7e92738cd010a18417/
Threat name:
ByteCode-MSIL.Downloader.Seraph
Create hunting rule
Status:
Malicious
First seen:
2023-01-17 11:06:17 UTC
File Type:
PE (.Net Exe)
Extracted files:
5
AV detection:
20 of 26 (76.92%)
Threat level:
  3/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zhq2thz5yjo3qihson6sn2alfxakl6f6ntqhw7usoognaefbqqlq._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
0a6b4d008994bb06574688d817089831fc7404e5e458c38e7a1464d072a8fd7a
RemcosRAT
50a13f6bced0bda92a35b13106f74959e15a48f47d18b04bc49ee95c82482cf7
RemcosRAT
923dece3727e56390fd3e56305a2e30f0599c6ae7b79877aa2c9823af34fcf9c
RemcosRAT
ae6134942672653a0652d8b74100de3c7bccd094ee66bbc0314e75b276cfb1c8
RemcosRAT
f0ba1150b808e391fd34e60538f46e4b2ee56c919a7fd4e2ec26e6ca27d2195d
RemcosRAT
f4fe0badd5c3bd5336955988d27f15b53f2eba9b42d8e9c0fe2e44aa2625c51f
RemcosRAT
f63f0aec05acdc4b6427334d073ead70d53709f1b47970bc04329b10f941cca1
RemcosRAT
+ 2'682 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:remotehost collection rat
Link:
https://tria.ge/reports/230117-m99kmsah8t/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Accesses Microsoft Outlook accounts
Drops startup file
NirSoft MailPassView
NirSoft WebBrowserPassView
Nirsoft
Remcos
Malware Config
C2 Extraction:
top.thekillforabuse1.xyz:1068
Unpacked files
SH256 hash:
8b4d30b9452632d684ebcc10db823188b816cac0447a9d75980554fa9ffc47c3
MD5 hash:
2c04026acf2961cae16f66c92389676e
SHA1 hash:
79cbd63bffd9590b69c95eb5d4049e774c83b57f
Detections:
Remcos
Create hunting rule
win_remcos_auto
Create hunting rule
Link:
https://www.unpac.me/results/c0913868-e3ea-4171-89d3-e31ac95300f3/
Parent samples :
f4fe0badd5c3bd5336955988d27f15b53f2eba9b42d8e9c0fe2e44aa2625c51f
c9e1a99f3dc25db820f2737d26e80b2dc0a5f8be6ce07b7e92738cd010a18417
SH256 hash:
bfa12a2456d40d6c32a1f4e35bd43c81f6f67466234faed8fec19397d0e6d808
MD5 hash:
7a7927bac28be846b2fd2a5d10ba0676
SHA1 hash:
67a7b8616fc8e7aa7bb7a6e2521548e67a7caa2d
Link:
https://www.unpac.me/results/c0913868-e3ea-4171-89d3-e31ac95300f3/
Parent samples :
fb110b1db7c02725d6cb0953cf153a2b5e158d358db136aece90ac06d79cb07d
80dd6d009a2b7ab7aa393d063048320db5ea3920a4fd9cca4a0a76f12183273f
SH256 hash:
c9e1a99f3dc25db820f2737d26e80b2dc0a5f8be6ce07b7e92738cd010a18417
MD5 hash:
a909ef85d431ee3ab40693f2335eae8d
SHA1 hash:
d033d2943c4732a5ca0fb16a681bea0225d2cb6e
Link:
https://www.unpac.me/results/c0913868-e3ea-4171-89d3-e31ac95300f3/
Malware family:
Remcos
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/c9e1a99f3dc2/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.92
Link:
https://yomi.yoroi.company/submissions/c9e1a99f3dc25db820f2737d26e80b2dc0a5f8be6ce07b7e92738cd010a18417

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:iexplorer_remcos
Create hunting rule
Author:iam-py-test
Description:Detect iexplorer being taken over by Remcos
Rule name:INDICATOR_EXE_Packed_ConfuserEx
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with ConfuserEx Mod
Rule name:INDICATOR_EXE_Packed_MPress
Create hunting rule
Author:ditekSHen
Description:Detects executables built or packed with MPress PE compressor
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer
Create hunting rule
Author:ditekSHen
Description:detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:pe_imphash
Create hunting rule
Rule name:QbotStuff
Create hunting rule
Author:anonymous
Rule name:Remcos
Create hunting rule
Author:kevoreilly
Description:Remcos Payload
Rule name:REMCOS_RAT_variants
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:TeslaCryptPackedMalware
Create hunting rule
Rule name:Windows_Trojan_Remcos_b296e965
Create hunting rule
Author:Elastic Security
Rule name:win_remcos_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.remcos.
Rule name:yara_template
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

Executable exe c9e1a99f3dc25db820f2737d26e80b2dc0a5f8be6ce07b7e92738cd010a18417

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/353742/

Comments