MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cc918d46ceafe7d60b4679a6a91d763b4d557b10acc87917d173aef865275a19. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 12


Intelligence 12 IOCs YARA 13 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cc918d46ceafe7d60b4679a6a91d763b4d557b10acc87917d173aef865275a19
SHA3-384 hash: c2783362c2c1dfcb614fa147594578a68c216670964daffb957fa86cacd1020086b370661b2b0bf54d3895708d149799
SHA1 hash: ca86acbc910d95e9603ca3ea2ec5e3282b254e3d
MD5 hash: 3e843c40ae032a1ba115347f4db18f7b
humanhash: single-johnny-lima-william
File name:SecuriteInfo.com.Trojan.PackedNET.535.22246.16689
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:460'288 bytes
First seen:2021-02-09 13:06:08 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'461 x Formbook, 12'202 x SnakeKeylogger)
ssdeep 12288:NRd5elsPe0+vl9uU73go3v4UqXn7/kSC+dI:DSsG0mbH13v4F7kS3
Threatray 1'519 similar samples on MalwareBazaar
TLSH 3EA49D2127D94B98E1BE9B765134501063F6FD17C722E65E3EA830EE1971B82C6B3723
Reporter SecuriteInfoCom
Tags:RemcosRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
99
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Cerere de pret NUM003112 09-02-2021.doc
Verdict:
Malicious activity
Analysis date:
2021-02-09 10:06:17 UTC
Tags:
trojan opendir exploit CVE-2017-11882 rat remcos
Link:
https://app.any.run/tasks/0d67742b-249c-44bf-874b-5f9bb02ec970

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Remcos
Create hunting rule
Link:
https://www.capesandbox.com/analysis/116183/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.535.22246.16689.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Creating a file
Creating a file in the %AppData% subdirectories
Enabling the 'hidden' option for recently created files
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a process with a hidden window
Deleting a recently created file
Running batch commands
Unauthorized injection to a recently created process
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
rans.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/602958
Signature
.NET source code contains potential unpacker
Allocates memory in foreign processes
Contains functionality to capture and log keystrokes
Contains functionality to inject code into remote processes
Contains functionality to register a low level keyboard hook
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Contains functionalty to change the wallpaper
Detected Remcos RAT
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Remcos
Sigma detected: Suspicious Svchost Process
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Writes to foreign memory regions
Yara detected AntiVM_3
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 350497 Sample: SecuriteInfo.com.Trojan.Pac... Startdate: 09/02/2021 Architecture: WINDOWS Score: 100 62 avatars.githubusercontent.com 2->62 64 github.map.fastly.net 2->64 66 github.com 2->66 86 Malicious sample detected (through community Yara rule) 2->86 88 Multi AV Scanner detection for submitted file 2->88 90 Detected Remcos RAT 2->90 92 7 other signatures 2->92 10 SecuriteInfo.com.Trojan.PackedNET.535.22246.exe 3 2->10         started        14 remcos.exe 3 2->14         started        signatures3 process4 file5 58 SecuriteInfo.com.T...T.535.22246.exe.log, ASCII 10->58 dropped 108 Contains functionalty to change the wallpaper 10->108 110 Contains functionality to steal Chrome passwords or cookies 10->110 112 Contains functionality to capture and log keystrokes 10->112 114 4 other signatures 10->114 16 SecuriteInfo.com.Trojan.PackedNET.535.22246.exe 4 5 10->16         started        60 C:\Users\user\AppData\...\remcos.exe.log, ASCII 14->60 dropped 19 remcos.exe 3 1 14->19         started        signatures6 process7 dnsIp8 54 C:\Users\user\AppData\Roaming\...\remcos.exe, PE32 16->54 dropped 56 C:\Users\user\...\remcos.exe:Zone.Identifier, ASCII 16->56 dropped 23 wscript.exe 1 16->23         started        68 167.88.9.90, 2050, 49721 NEXEONUS United States 19->68 94 Writes to foreign memory regions 19->94 96 Allocates memory in foreign processes 19->96 98 Injects a PE file into a foreign processes 19->98 25 svchost.exe 1 12 19->25         started        27 svchost.exe 19->27         started        30 svchost.exe 19->30         started        32 4 other processes 19->32 file9 signatures10 process11 dnsIp12 34 cmd.exe 1 23->34         started        36 iexplore.exe 156 25->36         started        70 192.168.2.1 unknown unknown 27->70 38 iexplore.exe 27->38         started        process13 process14 40 remcos.exe 34->40         started        43 conhost.exe 34->43         started        45 iexplore.exe 36->45         started        48 iexplore.exe 36->48         started        50 iexplore.exe 36->50         started        52 4 other processes 36->52 dnsIp15 100 Multi AV Scanner detection for dropped file 40->100 102 Contains functionalty to change the wallpaper 40->102 104 Contains functionality to steal Chrome passwords or cookies 40->104 106 2 other signatures 40->106 72 avatars.githubusercontent.com 45->72 82 3 other IPs or domains 45->82 74 avatars.githubusercontent.com 48->74 76 140.82.121.3, 443, 49749, 49750 GITHUBUS United States 48->76 78 avatars.githubusercontent.com 50->78 80 avatars.githubusercontent.com 52->80 84 3 other IPs or domains 52->84 signatures16
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cc918d46ceafe7d60b4679a6a91d763b4d557b10acc87917d173aef865275a19/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-02-09 08:58:14 UTC
File Type:
PE (.Net Exe)
Extracted files:
16
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zsiy2rwov7t5mc2gpgtkshlwhngvk6yqvtehsf6rooxpqzjhlimq._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
01fc5b16efa52a016379ce1a7908c6a71e7acacdabe58430a38ee9133d4e014b
RemcosRAT
157447fce775d3e303f51839e30994daedd62b93460ef617385ef8027585647d
RemcosRAT
1664c6a330c5b318458518ea71b2a9995a91c79281a050278c3aa2388663a986
RemcosRAT
2c32a940a48680ede0f03b2de30890a25c983ce91e2b7737d993a5ccb42677ba
RemcosRAT
581bd1167bd9b40944de9a2d8842ed8aa841fdfc69d896c24520873095e0ac03
RemcosRAT
63a4f89a7edeff9e5e817e8c61e8cff54cc5421bae27c35f343276991a52039b
RemcosRAT
88478956ea6c8ea5423e2c30e23fbbf893f4ebbcaa3718d407ac418bf9964c0e
RemcosRAT
ab77af2c0fe4a39b3e2ec7b7450ef36999baf7c66316f4b3934d5a60e124d50c
RemcosRAT
cb02d2d2301b7b9fb6a36b47f26a0bf46c9a3312cf15593322c93f41ac802ba1
RemcosRAT
dde6436d3e8a969f96e4ccec6904631d562efad960e0e9a6a2a865174750f3d6
RemcosRAT
+ 1'509 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos persistence ransomware rat
Link:
https://tria.ge/reports/210209-9xer8pt746/
Behaviour
Modifies registry class
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Loads dropped DLL
Executes dropped EXE
Remcos
Unpacked files
SH256 hash:
83282c55f3a41fe7ed907985814a05f177157e035d6867a58b6f8f77f446d711
MD5 hash:
cb8173fc9da5ef146126eade16ca441d
SHA1 hash:
0a4a4f6ced85b2e60020e2fa2a092e2226eecf27
Link:
https://www.unpac.me/results/78e2ab23-151b-4ef3-8577-ae3af77fdf80/
SH256 hash:
2b2bcf851c2b87033fd24c890c2a1de3642564f7cec7282982d96b8280baa849
MD5 hash:
befb0470c71d676cc891cba16088975d
SHA1 hash:
5b7143f97d1d656fd1cacf70949048c1951b639a
Link:
https://www.unpac.me/results/78e2ab23-151b-4ef3-8577-ae3af77fdf80/
SH256 hash:
b30948212b7815ea2dc5059f65e18b8a3c861078659c700ef180887a9058c679
MD5 hash:
ef1b887ca873d2f8444103e9fa13985c
SHA1 hash:
4363ce527ea7b3f827a36eb8877ebc944fbc0b54
Detections:
win_remcos_g0
Create hunting rule
win_remcos_auto
Create hunting rule
Link:
https://www.unpac.me/results/78e2ab23-151b-4ef3-8577-ae3af77fdf80/
SH256 hash:
9db93084133fd0f614f1ddcd0493e7f2cca9f2dc4ba908b21f496acd86c58325
MD5 hash:
b57f3209e06c7334b55b9ff2daa3dfa0
SHA1 hash:
3335e28da73cfceab2f21c5a8d5a29269c906d39
Link:
https://www.unpac.me/results/78e2ab23-151b-4ef3-8577-ae3af77fdf80/
SH256 hash:
cc918d46ceafe7d60b4679a6a91d763b4d557b10acc87917d173aef865275a19
MD5 hash:
3e843c40ae032a1ba115347f4db18f7b
SHA1 hash:
ca86acbc910d95e9603ca3ea2ec5e3282b254e3d
Link:
https://www.unpac.me/results/78e2ab23-151b-4ef3-8577-ae3af77fdf80/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/cc918d46ceafe7d60b4679a6a91d763b4d557b10acc87917d173aef865275a19

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_RemcosRAT
Create hunting rule
Author:abuse.ch
Rule name:Chrome_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Chrome in files like avemaria
Rule name:INDICATOR_EXE_Packed_MPress
Create hunting rule
Author:ditekSHen
Description:Detects executables built or packed with MPress PE compressor
Rule name:INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer
Create hunting rule
Author:ditekSHen
Description:detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Rule name:Keylog_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Contains Keylog
Rule name:Parallax
Create hunting rule
Author:@bartblaze
Description:Identifies Parallax RAT.
Rule name:Remcos
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Remcos in memory
Rule name:remcos_rat
Create hunting rule
Author:jeFF0Falltrades
Rule name:REMCOS_RAT_variants
Create hunting rule
Rule name:suspicious_packer_section
Create hunting rule
Author:@j0sm1
Description:The packer/protector section names/keywords
Reference:http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/
Rule name:win_remcos_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_remcos_g0
Create hunting rule
Author:Daniel Plohmann <daniel.plohmann<at>fkie.fraunhofer.de>

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RemcosRAT

Executable exe cc918d46ceafe7d60b4679a6a91d763b4d557b10acc87917d173aef865275a19

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/996946/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/116183/

Comments