MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cb2a13c8a77733a724fdd2148b253e65f2621aceedc4af14006d804495f7c80c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemoteManipulator


Vendor detections: 13


Intelligence 13 IOCs 1 YARA 24 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cb2a13c8a77733a724fdd2148b253e65f2621aceedc4af14006d804495f7c80c
SHA3-384 hash: d2c9f2412c901f3ac36c476b332331de2345784f73ef8bb1e46b27166caaefb25e0f8a2fd0349918966a1c36a0db46fe
SHA1 hash: 85ecf2125c8358def33f9eac2b09057015cb4ac2
MD5 hash: 5b2f645b5aa52d70b0533601d0153a7d
humanhash: low-vegan-summer-avocado
File name:5b2f645b5aa52d70b0533601d0153a7d.exe
Download: download sample
Signature RemoteManipulator
Create hunting rule
File size:27'111'408 bytes
First seen:2025-06-12 16:56:10 UTC
Last seen:2025-06-13 07:11:05 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 5f6c2f0686aaec4599e8b2b3a7893243 (5 x RemoteManipulator)
ssdeep 786432:Lm3+3Mz5wm9eD40u2FpFOc8Gc/xAPSXhVJ:22YDe80uqF5cpAqR
TLSH T19A5733C2E7D00955FEFF467599F94F0C4A3AED589B62670A02E8B312B0A3CC70956397
TrID 71.9% (.EXE) UPX compressed Win32 Executable (27066/9/6)
11.9% (.EXE) Win32 Executable (generic) (4504/4/1)
5.3% (.EXE) OS/2 Executable (generic) (2029/13)
5.3% (.EXE) Generic Win/DOS Executable (2002/3)
5.3% (.EXE) DOS Executable Generic (2000/1)
Magika pebin
dhash icon c0dacabacac0c244 (21 x RemoteManipulator)
Reporter abuse_ch
Tags:exe RemoteManipulator signed

Code Signing Certificate

Organisation:IP Ter-Osipov Aleksey Vladimirovich
Issuer:GlobalSign GCC R45 CodeSigning CA 2020
Algorithm:sha256WithRSAEncryption
Valid from:2022-10-18T05:48:13Z
Valid to:2025-10-18T05:48:13Z
Serial number: 76460e90e2844db7f9836b33
Intelligence: 11 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: 058be58d1b38932d090529d5cd022418b0f57f4f6d5bffacae817f18069225f0
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform


Avatar
abuse_ch
RemoteManipulator C2:
188.170.210.230:31043

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
188.170.210.230:31043 https://threatfox.abuse.ch/ioc/1544265/

Intelligence

File Origin
# of uploads :
3
# of downloads :
770
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
rms
Create hunting rule
ID:
1
File name:
5b2f645b5aa52d70b0533601d0153a7d.exe
Verdict:
Malicious activity
Analysis date:
2025-06-12 16:58:47 UTC
Tags:
rat rms upx delphi
Link:
https://app.any.run/tasks/6583ed98-861a-4c5b-b638-a6517f147632

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RemoteUtilitiesRAT
Create hunting rule
Link:
https://www.capesandbox.com/analysis/9193/
Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=684b06c68bd5d68a12e83e27
Tags:
phishing virus spawn blic
Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Creating a window
Searching for synchronization primitives
Creating a file in the %temp% subdirectories
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
adaptive-context embarcadero_delphi fingerprint keylogger lolbin overlay packed packed packed packed packer_detected remote signed upx
Link:
https://www.filescan.io/uploads/684b06befd02ed5e05a6ef19/reports/be8d6ba9-62db-47ba-8973-eb7f5630e0aa/overview
Verdict:
Malicious
Labled as:
Win/grayware_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/cb2a13c8a77733a724fdd2148b253e65f2621aceedc4af14006d804495f7c80c
Result
Threat name:
RMSRemoteAdmin
Create hunting rule
Detection:
malicious
Classification:
evad
Score:
40 / 100
Link:
https://www.joesandbox.com/analysis/1713511
Signature
Antivirus / Scanner detection for submitted sample
Changes security center settings (notifications, updates, antivirus, firewall)
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Query firmware table information (likely to detect VMs)
Sigma detected: Rare Remote Thread Creation By Uncommon Source Image
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1713511 Sample: 9Snleq3ONa.exe Startdate: 12/06/2025 Architecture: WINDOWS Score: 40 76 rms.apteka-aprel.ru 2->76 80 Malicious sample detected (through community Yara rule) 2->80 82 Antivirus / Scanner detection for submitted sample 2->82 84 Multi AV Scanner detection for submitted file 2->84 86 2 other signatures 2->86 8 msiexec.exe 97 106 2->8         started        11 rutserv.exe 2->11         started        15 svchost.exe 2->15         started        17 8 other processes 2->17 signatures3 process4 dnsIp5 60 C:\Program Files (x86)\...\rutserv.exe, PE32 8->60 dropped 62 C:\Program Files (x86)\...\rfusclient.exe, PE32 8->62 dropped 64 server_stop_27D787...EA10FB36BB4D2F9.exe, PE32 8->64 dropped 72 41 other files (none is malicious) 8->72 dropped 19 rutserv.exe 81 6 8->19         started        22 rutserv.exe 2 8->22         started        24 rutserv.exe 2 8->24         started        34 3 other processes 8->34 78 rms.apteka-aprel.ru 188.170.210.230, 31043, 49728 MF-KAVKAZ-ASRU Russian Federation 11->78 90 Query firmware table information (likely to detect VMs) 11->90 26 rfusclient.exe 11->26         started        28 rfusclient.exe 11->28         started        92 Changes security center settings (notifications, updates, antivirus, firewall) 15->92 30 MpCmdRun.exe 15->30         started        66 C:\Windows\system32\...\unires_vpd.dll (copy), PE32+ 17->66 dropped 68 C:\Windows\...\unidrvui_rppd.dll (copy), PE32+ 17->68 dropped 70 C:\Windows\...\unidrv_rppd.dll (copy), PE32+ 17->70 dropped 74 5 other files (none is malicious) 17->74 dropped 32 msiexec.exe 17->32         started        file6 signatures7 process8 signatures9 36 setupdrv.exe 19->36         started        39 srvinst.exe 19->39         started        41 setupdrv.exe 19->41         started        43 srvinst.exe 19->43         started        88 Query firmware table information (likely to detect VMs) 26->88 45 rfusclient.exe 26->45         started        48 conhost.exe 30->48         started        process10 file11 50 C:\Windows\System32\spool\...\unires_vpd.dll, PE32+ 36->50 dropped 52 C:\Windows\System32\...\unidrvui_rppd.dll, PE32+ 36->52 dropped 54 C:\Windows\System32\spool\...\unidrv_rppd.dll, PE32+ 36->54 dropped 58 2 other files (none is malicious) 36->58 dropped 56 C:\Program Files (x86)\...\VPDAgent.exe, PE32 39->56 dropped 94 Query firmware table information (likely to detect VMs) 45->94 signatures12
Score:
89%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/cb2a13c8a77733a724fdd2148b253e65f2621aceedc4af14006d804495f7c80c
Gathering data
Threat name:
Win32.Malware.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2025-06-08 11:06:35 UTC
File Type:
PE (Exe)
Extracted files:
2047
AV detection:
19 of 36 (52.78%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zmvbhsfho4z2ojh52ikiwjj6mxzgegwo5xck6faanwaejfpxzaga._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
discovery persistence upx
Link:
https://tria.ge/reports/250612-vfszsszwhy/
Behaviour
Checks SCSI registry key(s)
Modifies data under HKEY_USERS
Modifies registry class
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Embeds OpenSSL
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Checks installed software on the system
Drops file in Program Files directory
Drops file in Windows directory
Executes dropped EXE
Loads dropped DLL
Checks computer location settings
Drops file in System32 directory
UPX packed file
Blocklisted process makes network request
Enumerates connected drives
Boot or Logon Autostart Execution: Port Monitors
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/7a9150c8-c229-46cf-827a-4b5c6eebfaaa
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/cb2a13c8a777/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/cb2a13c8a77733a724fdd2148b253e65f2621aceedc4af14006d804495f7c80c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BLOWFISH_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for Blowfish constants
Rule name:BobSoftMiniDelphiBoBBobSoft
Create hunting rule
Author:malware-lu
Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:botnet_plaintext_c2
Create hunting rule
Author:cip
Description:Attempts to match at least some of the strings used in some botnet variants which use plaintext communication protocols.
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:growtopia
Create hunting rule
Author:Michelle Khalil
Description:This rule detects unpacked growtopia stealer malware samples.
Rule name:MALWARE_Win_RemoteUtilitiesRAT
Create hunting rule
Author:ditekSHen
Description:RemoteUtilitiesRAT RAT payload
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:UPX290LZMAMarkusOberhumerLaszloMolnarJohnReiser
Create hunting rule
Author:malware-lu
Rule name:UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser
Create hunting rule
Author:malware-lu
Rule name:upx_largefile
Create hunting rule
Author:k3nr9
Rule name:Windows_Trojan_Remotemanipulator_9ec52153
Create hunting rule
Author:Elastic Security
Rule name:win_rms_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_upx_packed
Create hunting rule
Author:Reedus0
Description:Rule for detecting UPX packed malware
Rule name:with_urls
Create hunting rule
Author:Antonio Sanchez <asanchez@hispasec.com>
Description:Rule to detect the presence of an or several urls
Reference:http://laboratorio.blogs.hispasec.com/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/9193/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_TRUST_INFORequires Elevated Execution (level:requireAdministrator)high
Reviews
IDCapabilitiesEvidence
MULTIMEDIA_APICan Play Multimediawinmm.dll::timeGetTime
SHELL_APIManipulates System Shellshell32.dll::ShellExecuteW
WIN_BASE_APIUses Win Base APIKERNEL32.DLL::LoadLibraryA
WIN_REG_APICan Manipulate Windows Registryadvapi32.dll::RegLoadKeyW

Comments