MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cf6de5f333dea0ffbc94ef944a23c99db28e66e7d51757d01a9a017a21fb8837. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 17


Intelligence 17 IOCs YARA 3 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cf6de5f333dea0ffbc94ef944a23c99db28e66e7d51757d01a9a017a21fb8837
SHA3-384 hash: 3e407345353a7f04d872687ad7fa908afdd063fae8e687d1e812154edab443532f2eed988825a289673fca46d86d3636
SHA1 hash: 0237651643b1b1ae9e76c27093a9ab43fe8e1a51
MD5 hash: ece373b3964de43caf73e842e38703ae
humanhash: apart-jupiter-wisconsin-north
File name:ece373b3964de43caf73e842e38703ae
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:2'192'384 bytes
First seen:2023-03-08 22:10:37 UTC
Last seen:2023-03-08 23:32:33 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'747 x AgentTesla, 19'633 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 24576:9kGLeyv8GLHgD9s6Hi6zstYuzdtiCxFKtW33HTwHojrNsGeKWjO1sli+Q:9jeu/6uz+8FKoqjY+Q
Threatray 1'678 similar samples on MalwareBazaar
TLSH T1C8A59EF09E93FE8097AB2C8490CC2AD09C4C1B9B829D9548FCDC2556E2E5694FFDD5B0
TrID 63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.2% (.SCR) Windows screen saver (13097/50/3)
9.0% (.EXE) Win64 Executable (generic) (10523/12/4)
5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.8% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter zbetcheckin
Tags:32 exe RemcosRAT

Intelligence

File Origin
# of uploads :
2
# of downloads :
241
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
remcos
Create hunting rule
ID:
1
File name:
New Order Match 2023SI33490 .xls
Verdict:
Malicious activity
Analysis date:
2023-03-08 21:02:59 UTC
Tags:
opendir exploit cve-2017-11882 loader rat remcos keylogger
Link:
https://app.any.run/tasks/80478f83-dfb8-4d78-9c02-0cc48d42c065

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Remcos
Create hunting rule
Link:
https://www.capesandbox.com/analysis/372794/
Detection(s):
SecuriteInfo.com.Trojan.Inject4.30942.12782.17242.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Launching a process
Creating a process with a hidden window
Sending a custom TCP request
Creating a file in the %AppData% subdirectories
Unauthorized injection to a recently created process
Creating a file
Setting a keyboard event handler
DNS request
Sending an HTTP GET request
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
stealer
Link:
https://www.filescan.io/uploads/640907face680ea731cc5447/reports/b778c498-49b0-47f0-80af-9f9a1666a337/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/cf6de5f333dea0ffbc94ef944a23c99db28e66e7d51757d01a9a017a21fb8837
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f75b6a46-5261-49e8-aaa5-6cf142dc33b6
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1189865
Signature
C2 URLs / IPs found in malware configuration
Encrypted powershell cmdline option found
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Remcos
Uses dynamic DNS services
Yara detected Generic Downloader
Yara detected Remcos RAT
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 822753 Sample: n56uF13ZR7.exe Startdate: 08/03/2023 Architecture: WINDOWS Score: 100 50 Malicious sample detected (through community Yara rule) 2->50 52 Multi AV Scanner detection for submitted file 2->52 54 Yara detected UAC Bypass using CMSTP 2->54 56 6 other signatures 2->56 7 n56uF13ZR7.exe 1 7 2->7         started        11 Wikhqpjb.exe 4 2->11         started        13 Wikhqpjb.exe 3 2->13         started        process3 file4 38 C:\Users\user\AppData\...\Wikhqpjb.exe, PE32 7->38 dropped 40 C:\Users\...\Wikhqpjb.exe:Zone.Identifier, ASCII 7->40 dropped 42 C:\Users\user\AppData\...\n56uF13ZR7.exe.log, ASCII 7->42 dropped 58 Encrypted powershell cmdline option found 7->58 60 Injects a PE file into a foreign processes 7->60 15 n56uF13ZR7.exe 2 17 7->15         started        20 powershell.exe 16 7->20         started        62 Multi AV Scanner detection for dropped file 11->62 64 Machine Learning detection for dropped file 11->64 22 powershell.exe 13 11->22         started        24 Wikhqpjb.exe 11->24         started        26 powershell.exe 13 13->26         started        28 Wikhqpjb.exe 13->28         started        signatures5 process6 dnsIp7 44 yasinkayites.ddns.net 91.192.100.17, 2049, 49706 AS-SOFTPLUSCH Switzerland 15->44 46 geoplugin.net 178.237.33.50, 49707, 80 ATOM86-ASATOM86NL Netherlands 15->46 36 C:\ProgramData\remcos\logs.dat, data 15->36 dropped 48 Installs a global keyboard hook 15->48 30 conhost.exe 20->30         started        32 conhost.exe 22->32         started        34 conhost.exe 26->34         started        file8 signatures9 process10
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cf6de5f333dea0ffbc94ef944a23c99db28e66e7d51757d01a9a017a21fb8837/
Threat name:
ByteCode-MSIL.Trojan.Seraph
Create hunting rule
Status:
Malicious
First seen:
2023-03-08 12:52:45 UTC
File Type:
PE (.Net Exe)
Extracted files:
3
AV detection:
18 of 25 (72.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=z5w6l4zt32qp7peu56keui6jtwzi4zxh2ulvpua2tiaxuip3ra3q._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
02ced6da9cf24901681948deae308d36975cb623dcc6735f2142f4252bc7e197
RemcosRAT
08bc96eb8f857b9e84b4536d96ddb85e8be8329f8572b8b91d4d645e79a84ccc
RemcosRAT
305e9aa2df19b77ad92b897543e803b5dea0c851b37cf8c9b4e2206282343946
RemcosRAT
3a20e81b1f0bf0699007470e5a8e2a9a0d6507ea99696f0df9bd99b80910d656
RemcosRAT
5ca676b334d8a3f4542877a696a7092b29dbdeddabcd70af2a80e5c8384a75b6
RemcosRAT
7e82cf496170e81178aa01bb117531aaf096b2ee9797e5d82e6e141ad550c0ef
RemcosRAT
9846c8ffd0aec6ff3c8b8db350032e4d9586ac6aa22b06944672c837d3bbcf28
RemcosRAT
ce4f7b095af43eceb75710f074f5c39eaf53039cd470ad6e56c254af33a0b0a3
RemcosRAT
dabb657acfa0d239bcd7f26fa84eb567790a3ab47d46bbf1a3bb9f5c4e6e3b25
RemcosRAT
+ 1'668 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:test1host persistence rat
Link:
https://tria.ge/reports/230308-13xt6agc9t/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Checks computer location settings
Remcos
Malware Config
C2 Extraction:
yasinkayites.ddns.net:2049
Unpacked files
SH256 hash:
a1359ce084f5222f86b5af1e1bf8d6396bb27584f35da89d4220c1cf41d01b4d
MD5 hash:
db1628f1cfc7153c19a43782ae28a297
SHA1 hash:
fcf3934a98c117dd9c222ba9414f7a6bb5aa9b73
Detections:
Remcos
Create hunting rule
win_remcos_auto
Create hunting rule
Link:
https://www.unpac.me/results/aa22f1e9-8c77-49ae-8058-dedf071299b5/
Parent samples :
cf6de5f333dea0ffbc94ef944a23c99db28e66e7d51757d01a9a017a21fb8837
78b009999d967e2d3eeb4a10ce91c84048dc566d2a74d8e223a6a5b15db5839b
SH256 hash:
6ae660b9148040f75b137862b7e04d50effa63dc9dde748cc7dc979fcd45e139
MD5 hash:
e1c864a1e01774a9ce1cee72f66d38a8
SHA1 hash:
e3e2d9514000ff6a9ef8bade9890d9b037750155
Link:
https://www.unpac.me/results/aa22f1e9-8c77-49ae-8058-dedf071299b5/
SH256 hash:
ff8c24bce1eb009f0d5c47a09b96caf02726c285cea0d635082ad4da27e63d1b
MD5 hash:
9d6ec6072ee1814a4a01d1eb3fb67ba1
SHA1 hash:
d0b416de1c900b6bcb35dc182b2e8744f16c3289
Link:
https://www.unpac.me/results/aa22f1e9-8c77-49ae-8058-dedf071299b5/
SH256 hash:
d23097ac5552df29a65141aeb02032811bb2df10e2ddcf022ddcfb24b06bbbf9
MD5 hash:
71c088ba5c9fc0329f768ee030feb521
SHA1 hash:
9a7342af1ecbc5538b90b7c28a630215c5017c80
Link:
https://www.unpac.me/results/aa22f1e9-8c77-49ae-8058-dedf071299b5/
SH256 hash:
a98cf6bca3bae8aa6919668520a270f60d616321b91b689b8d9012cad8d8dc2a
MD5 hash:
f94cc76b3d6593249e9a80c2ebda6c4b
SHA1 hash:
2f067ae346941c85636761e84098299298fcae47
Detections:
win_remcos_auto
Create hunting rule
Link:
https://www.unpac.me/results/aa22f1e9-8c77-49ae-8058-dedf071299b5/
SH256 hash:
cf6de5f333dea0ffbc94ef944a23c99db28e66e7d51757d01a9a017a21fb8837
MD5 hash:
ece373b3964de43caf73e842e38703ae
SHA1 hash:
0237651643b1b1ae9e76c27093a9ab43fe8e1a51
Link:
https://www.unpac.me/results/aa22f1e9-8c77-49ae-8058-dedf071299b5/
Malware family:
Remcos
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/cf6de5f333de/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/cf6de5f333dea0ffbc94ef944a23c99db28e66e7d51757d01a9a017a21fb8837

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RemcosRAT

Executable exe cf6de5f333dea0ffbc94ef944a23c99db28e66e7d51757d01a9a017a21fb8837

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2563450/
Cape
Cape
https://www.capesandbox.com/analysis/372794/

Comments


Avatar
zbet commented on 2023-03-08 22:10:38 UTC

url : hxxp://23.94.99.117/3591/vbc.exe