MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cd4d28a18dcf8944c2d6363a30fe0cbca2b1d52d48b43ae46965edfba8c8b013. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 18


Intelligence 18 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cd4d28a18dcf8944c2d6363a30fe0cbca2b1d52d48b43ae46965edfba8c8b013
SHA3-384 hash: 57348403dab2d95a44b965b19b3fa952fef643362d678af90eb875554fc6ae3f3b4e95152537f25add6c9a2d6a9d12a1
SHA1 hash: 3a12838170a93d401ebd0081fde14e26342a78f7
MD5 hash: 99de3db1171255a9e1e8f5caf97966c3
humanhash: massachusetts-iowa-sixteen-tango
File name:cd4d28a18dcf8944c2d6363a30fe0cbca2b1d52d48b43ae46965edfba8c8b013
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:86'528 bytes
First seen:2023-03-13 07:10:07 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash d3a62971944197f0701c7049a9c739d1 (60 x RemcosRAT)
ssdeep 1536:/hhW0YTGZWdVseJxaM9kraLdV2QkQ1TbPX8IHOCkIsI4ESHNTh9E+JP19qkP60r:ZhzYTGWVvJ8f2v1TbPzuMsIFSHNThy+b
Threatray 401 similar samples on MalwareBazaar
TLSH T15B83D813FA4AD0B2E46591F145426F32CEBCBC3636492173D38FCA41AD79892D416EAF
TrID 33.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
17.6% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
14.0% (.SCR) Windows screen saver (13097/50/3)
11.2% (.EXE) Win64 Executable (generic) (10523/12/4)
7.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
File icon (PE):PE icon
dhash icon 989894b49c9494f0 (43 x RemcosRAT)
Reporter adrian__luca
Tags:exe RemcosRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
216
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
remcos
Create hunting rule
ID:
1
File name:
cd4d28a18dcf8944c2d6363a30fe0cbca2b1d52d48b43ae46965edfba8c8b013
Verdict:
Malicious activity
Analysis date:
2023-03-13 07:24:44 UTC
Tags:
remcos
Link:
https://app.any.run/tasks/230bed81-0adb-4719-ad77-51eff5060be5

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Remcos
Create hunting rule
Link:
https://www.capesandbox.com/analysis/373865/
Detection(s):
Win.Malware.Azden-7587127-0
Create hunting rule

Win.Malware.Rescoms-6598304-0
Create hunting rule

Win.Malware.Zusy-6832224-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Launching cmd.exe command interpreter
Creating a file in the Windows subdirectories
Enabling the 'hidden' option for recently created files
Creating a file in the %temp% directory
Launching a process
Changing a file
Creating a file
Running batch commands
Creating a process with a hidden window
Creating a process from a recently created file
Setting a keyboard event handler
Creating a window
Sending a custom TCP request
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Blocking the User Account Control
Query of malicious DNS domain
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/72896/overview
Behaviour
MalwareBazaar
Verdict:
Malicious
Threat level:
  10/10
Confidence:
75%
Tags:
anti-debug anti-vm cmd.exe eventvwr.exe explorer.exe fingerprint greyware keylogger remcos shell32.dll
Link:
https://www.filescan.io/uploads/640ecc8886958b4d2a275eb4/reports/ba29d646-901c-4253-a3d9-ee28da0ccb94/overview
Verdict:
Malicious
Labled as:
BKDR_SOCMER.SM
Link:
https://www.hybrid-analysis.com/sample/cd4d28a18dcf8944c2d6363a30fe0cbca2b1d52d48b43ae46965edfba8c8b013
Malware family:
REMCOS
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/ed5e0f56-ddc2-4233-9873-447936e4449f
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1192230
Signature
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Contains functionality to capture and log keystrokes
Contains functionality to detect virtual machines (IN, VMware)
Contains functionality to inject code into remote processes
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Creates an autostart registry key pointing to binary in C:\Windows
Detected Remcos RAT
Disables UAC (registry)
Drops executables to the windows directory (C:\Windows) and starts them
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Tries to delay execution (extensive OutputDebugStringW loop)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
UAC bypass detected (mscfile / eventvwr.exe)
Uses cmd line tools excessively to alter registry or file data
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Writes to foreign memory regions
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 825106 Sample: 3CnHCsrJWs.exe Startdate: 13/03/2023 Architecture: WINDOWS Score: 100 77 Malicious sample detected (through community Yara rule) 2->77 79 Antivirus detection for dropped file 2->79 81 Antivirus / Scanner detection for submitted sample 2->81 83 9 other signatures 2->83 9 3CnHCsrJWs.exe 1 5 2->9         started        13 Windows Start-Up Audio.exe 1 1 2->13         started        15 Windows Start-Up Audio.exe 2 1 2->15         started        process3 file4 59 C:\Windows\...\Windows Start-Up Audio.exe, PE32 9->59 dropped 61 Windows Start-Up A...exe:Zone.Identifier, ASCII 9->61 dropped 85 Contains functionality to detect virtual machines (IN, VMware) 9->85 87 Contains functionality to steal Chrome passwords or cookies 9->87 89 Contains functionality to capture and log keystrokes 9->89 101 3 other signatures 9->101 17 cmd.exe 1 9->17         started        20 cmd.exe 1 9->20         started        91 Detected Remcos RAT 13->91 93 Writes to foreign memory regions 13->93 95 Allocates memory in foreign processes 13->95 97 Injects a PE file into a foreign processes 13->97 22 cmd.exe 13->22         started        24 iexplore.exe 13->24         started        99 UAC bypass detected (mscfile / eventvwr.exe) 15->99 26 eventvwr.exe 15->26         started        28 eventvwr.exe 15->28         started        signatures5 process6 signatures7 69 Uses ping.exe to sleep 17->69 71 Drops executables to the windows directory (C:\Windows) and starts them 17->71 30 Windows Start-Up Audio.exe 2 1 17->30         started        33 PING.EXE 1 17->33         started        36 conhost.exe 17->36         started        73 Uses cmd line tools excessively to alter registry or file data 20->73 75 Uses ping.exe to check the status of other devices and networks 20->75 38 reg.exe 1 20->38         started        40 conhost.exe 20->40         started        42 conhost.exe 22->42         started        44 reg.exe 22->44         started        46 mmc.exe 26->46         started        process8 dnsIp9 103 Detected Remcos RAT 30->103 105 Writes to foreign memory regions 30->105 107 Allocates memory in foreign processes 30->107 109 Injects a PE file into a foreign processes 30->109 48 cmd.exe 30->48         started        51 iexplore.exe 30->51         started        63 127.0.0.1 unknown unknown 33->63 111 Disables UAC (registry) 38->111 53 mmc.exe 5 14 46->53         started        signatures10 process11 signatures12 65 Uses cmd line tools excessively to alter registry or file data 48->65 55 conhost.exe 48->55         started        57 reg.exe 1 48->57         started        67 Tries to delay execution (extensive OutputDebugStringW loop) 53->67 process13
Detection:
remcos
Create hunting rule
Link:
https://mwdb.cert.pl/sample/cd4d28a18dcf8944c2d6363a30fe0cbca2b1d52d48b43ae46965edfba8c8b013/
Threat name:
Win32.Backdoor.Rescoms
Create hunting rule
Status:
Malicious
First seen:
2023-03-13 07:11:09 UTC
File Type:
PE (Exe)
Extracted files:
2
AV detection:
24 of 24 (100.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zvgsrimnz6eujqwwgy5db7qmxsrldvjnjc2dvzdjmxw7xkgiwajq._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
05e1c9b65c5c34d39abe5682f747ef5debcc931d768f0023644a39233a553405
RemcosRAT
2435aff7e691f28e5b1e98780fde77e2d690f088f0205f69a648c7eaa55ef076
RemcosRAT
334c23c94f9c6587e2afd0689796daa8791fda9b823b23836893b86f5cce849f
RemcosRAT
4cbf921ca59d8725280de0d34864dc44eb98fadde5ea010683a8f8820eb3b803
RemcosRAT
5107b9fda1ce6e7c51fb52d7928c49a82731ff4fc3c75d700737ce3c2f274044
RemcosRAT
57fbc090b3644bb9760b859c6bbdc8486892d10736adcc1dd6dca642e218acf7
RemcosRAT
9367f2fed062c994290b2eff35d3560ead41338e9879d15ec49df4c7e8acd358
RemcosRAT
96d0368486de7d7dff9a894fde1ecc2138fe2cd4835b52d5e03a890d174f29fe
RemcosRAT
d92ad864a7ceb69d94b5247c94dc7cec67a58ff72347738d695820f9b841e379
RemcosRAT
ebb443f00afcb7b69099209821b747076d16ec48c76c13100c9e15da7ed2beda
RemcosRAT
+ 391 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:update evasion persistence rat trojan
Link:
https://tria.ge/reports/230313-hzym6sba31/
Behaviour
Modifies registry key
Runs ping.exe
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Windows directory
Suspicious use of SetThreadContext
Adds Run key to start application
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Remcos
UAC bypass
Malware Config
C2 Extraction:
ytuna1709.duckdns.org:3035
Unpacked files
SH256 hash:
cd4d28a18dcf8944c2d6363a30fe0cbca2b1d52d48b43ae46965edfba8c8b013
MD5 hash:
99de3db1171255a9e1e8f5caf97966c3
SHA1 hash:
3a12838170a93d401ebd0081fde14e26342a78f7
Detections:
Remcos
Create hunting rule
win_remcos_auto
Create hunting rule
win_remcos_g0
Create hunting rule
Link:
https://www.unpac.me/results/f0534187-7c63-46da-a423-e85dee4346b6/
Malware family:
Remcos
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/cd4d28a18dcf/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/cd4d28a18dcf8944c2d6363a30fe0cbca2b1d52d48b43ae46965edfba8c8b013

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CMD_Ping_Localhost
Create hunting rule
Rule name:INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer
Create hunting rule
Author:ditekSHen
Description:detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Rule name:malware_Remcos_strings
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Remcos in memory
Rule name:Remcos
Create hunting rule
Author:kevoreilly
Description:Remcos Payload
Rule name:remcos_rat
Create hunting rule
Author:jeFF0Falltrades
Rule name:REMCOS_RAT_variants
Create hunting rule
Rule name:win_remcos_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.remcos.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

Executable exe cd4d28a18dcf8944c2d6363a30fe0cbca2b1d52d48b43ae46965edfba8c8b013

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/373865/

Comments