MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cf8056e691bd5d73dbffedb8228a1cb2bee27791633c7cf2114041112f66b93d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 17


Intelligence 17 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cf8056e691bd5d73dbffedb8228a1cb2bee27791633c7cf2114041112f66b93d
SHA3-384 hash: 0e00b03374430741c40d6054b1592ab88c50fde64b74e7514bd05740959ec96e6bad23b419a5dfcea41b1636b42bed5c
SHA1 hash: b8f3ddf5408e1fa07f27f525e6cc547c59efdcf1
MD5 hash: f1ebe62c0ab6fc311d1e02faf85b0c58
humanhash: yellow-lemon-johnny-social
File name:FedEx 00237794891929_MI_20239002382_pdf.exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:484'278 bytes
First seen:2023-05-11 06:25:05 UTC
Last seen:2023-05-13 22:51:18 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 61259b55b8912888e90f516ca08dc514 (1'059 x Formbook, 741 x AgentTesla, 427 x GuLoader)
ssdeep 12288:vYM0aRhA+gi3DlBtme5whQ8qxvSRBpkY4nfjJqKcZJPq0gaB:vYM0t+giJBtX5aQNxqp2jcSc
Threatray 1'893 similar samples on MalwareBazaar
TLSH T184A423141BE864E7ED1212763E7EE36D4FD0F9224BD12A479FC05E9D64A5A80CD0E3B2
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon b2a89c96a2cada72 (2'283 x Formbook, 981 x Loki, 803 x AgentTesla)
Reporter cocaman
Tags:exe RemcosRAT

Intelligence

File Origin
# of uploads :
9
# of downloads :
282
Origin country :
CH CH
Vendor Threat Intelligence
Malware family:
remcos
Create hunting rule
ID:
1
File name:
FedEx 00237794891929_MI_20239002382_pdf.exe
Verdict:
Malicious activity
Analysis date:
2023-05-11 06:26:07 UTC
Tags:
remcos
Link:
https://app.any.run/tasks/12fea705-0a70-4814-a637-1504f859d64a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Remcos
Create hunting rule
Link:
https://www.capesandbox.com/analysis/388341/
Detection(s):
SecuriteInfo.com.Gen.Variant.Nemesis.22774.11569.22511.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a file in the %temp% directory
Creating a window
Creating a file
Creating a file in the %AppData% subdirectories
Unauthorized injection to a recently created process
Сreating synchronization primitives
Sending a custom TCP request
DNS request
Sending an HTTP GET request
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/83469/overview
Behaviour
MalwareBazaar
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
comodo nemesis overlay packed remcos shell32.dll
Link:
https://www.filescan.io/uploads/645c8a7b4698ab2675292229/reports/c55ea755-0941-4d1c-af59-9e03958a0b67/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/cf8056e691bd5d73dbffedb8228a1cb2bee27791633c7cf2114041112f66b93d
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
REMCOS
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/acf3b7e9-6450-449c-ba33-15eef6c7270c
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1230554
Signature
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Contains functionality to bypass UAC (CMSTPLUA)
Contains functionality to modify clipboard data
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Delayed program exit found
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Found malware configuration
Initial sample is a PE file and has a suspicious name
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sample uses string decryption to hide its real strings
Sigma detected: Remcos
Yara detected Remcos RAT
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 863532 Sample: FedEx_00237794891929_MI_202... Startdate: 11/05/2023 Architecture: WINDOWS Score: 100 38 Found malware configuration 2->38 40 Malicious sample detected (through community Yara rule) 2->40 42 Antivirus detection for dropped file 2->42 44 10 other signatures 2->44 6 ueajsoxsclhq.exe 19 2->6         started        10 FedEx_00237794891929_MI_20239002382_pdf.exe 1 21 2->10         started        12 ueajsoxsclhq.exe 19 2->12         started        process3 dnsIp4 24 C:\Users\user\AppData\...\chgwonbgvt.dll, PE32 6->24 dropped 46 Multi AV Scanner detection for dropped file 6->46 48 Contains functionality to bypass UAC (CMSTPLUA) 6->48 50 Detected unpacking (changes PE section rights) 6->50 56 6 other signatures 6->56 15 ueajsoxsclhq.exe 6->15         started        26 C:\Users\user\AppData\...\ueajsoxsclhq.exe, PE32 10->26 dropped 28 C:\Users\user\AppData\...\chgwonbgvt.dll, PE32 10->28 dropped 52 Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors) 10->52 54 Maps a DLL or memory area into another process 10->54 17 FedEx_00237794891929_MI_20239002382_pdf.exe 3 13 10->17         started        20 conhost.exe 10->20         started        36 192.168.2.1 unknown unknown 12->36 30 C:\Users\user\AppData\...\chgwonbgvt.dll, PE32 12->30 dropped 22 ueajsoxsclhq.exe 12->22         started        file5 signatures6 process7 dnsIp8 32 64.112.85.218, 4888, 49691, 49699 UNIREGISTRYKY Reserved 17->32 34 geoplugin.net 178.237.33.50, 49692, 80 ATOM86-ASATOM86NL Netherlands 17->34
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cf8056e691bd5d73dbffedb8228a1cb2bee27791633c7cf2114041112f66b93d/
Threat name:
Win32.Trojan.Nemesis
Create hunting rule
Status:
Malicious
First seen:
2023-05-11 02:38:05 UTC
File Type:
PE (Exe)
Extracted files:
3
AV detection:
25 of 37 (67.57%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=z6afnzurxvoxhw775w4cfcq4wk7oe54rmm6hz4qribarcl3gxe6q._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
1a925bac006fd8d7a5d58d0229eabe2e30634626731add96939b0ab542c446a5
RemcosRAT
5458794f2a5d1f35a638a4278fba37217461303123c22054e45bc536e254c4a2
RemcosRAT
6a43f8d13e49fac946dfcd323542f4f77a43c813c9d52a8273d5421f1049fa9e
RemcosRAT
71413583e55230a0a3a659cae17e5a23da5db0b660ed850b268c16680945995a
RemcosRAT
75b45c924b0796b2dd96b96e9602c6039b18e5be28c1d6f5dd9ebcfd0668fd64
RemcosRAT
9f9472ff68d38143574eebb20c6c45ad9e1ef8905c8a2fbf6bf5ff8ab30ec2f0
RemcosRAT
affea1453f9f47d6001811fd802e604e46fe94ecdb32da84ca21a3ed5db9b308
RemcosRAT
df5481a99a394e2019c2665fa75f4b81bb4cf0afcd5b7c268ea6f01988ece3fc
RemcosRAT
+ 1'883 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:remotehost persistence rat
Link:
https://tria.ge/reports/230511-g663fsdh9y/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Loads dropped DLL
Remcos
Malware Config
C2 Extraction:
64.112.85.218:4888
Unpacked files
SH256 hash:
f4ad1130a000eef80b3786a74fa4245304dc0e32be32029a58d1f96f4d51a358
MD5 hash:
746106eaa684bec69cd7e6a7e706ec85
SHA1 hash:
749adbfaf4830cf658e5e7e0aeeddef2723b0c36
Link:
https://www.unpac.me/results/544b22e9-ee67-4baa-bf82-bbee89e28562/
SH256 hash:
0fd3b2b83fd32d325c883e0c6a576bb2dd9f2f37973eca5b9095fca7fce0e108
MD5 hash:
2f4a0cb398c13ca691687b3b1a98e90e
SHA1 hash:
5f7a070f3ff0a81941dfff94f194e9350306297e
Detections:
Remcos
Create hunting rule
win_remcos_auto
Create hunting rule
Link:
https://www.unpac.me/results/544b22e9-ee67-4baa-bf82-bbee89e28562/
Parent samples :
19836f65b08970b838c64ef0ffd5f8f4d8ed2063a1df2b826e3dc9e66b3c8f37
1a925bac006fd8d7a5d58d0229eabe2e30634626731add96939b0ab542c446a5
3bebabea8a9d00a8add9979fe330b1e0494a4595677929f8c94f3d7e9e04997d
cf8056e691bd5d73dbffedb8228a1cb2bee27791633c7cf2114041112f66b93d
d6f7d0850a40002f01cc66f19db67872e8606dd114825a351fcd618b8f375599
SH256 hash:
cf8056e691bd5d73dbffedb8228a1cb2bee27791633c7cf2114041112f66b93d
MD5 hash:
f1ebe62c0ab6fc311d1e02faf85b0c58
SHA1 hash:
b8f3ddf5408e1fa07f27f525e6cc547c59efdcf1
Link:
https://www.unpac.me/results/544b22e9-ee67-4baa-bf82-bbee89e28562/
Malware family:
Remcos
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/cf8056e691bd/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:iexplorer_remcos
Create hunting rule
Author:iam-py-test
Description:Detect iexplorer being taken over by Remcos
Rule name:INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
Create hunting rule
Author:ditekSHen
Description:Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Rule name:Remcos
Create hunting rule
Author:kevoreilly
Description:Remcos Payload
Rule name:REMCOS_RAT_variants
Create hunting rule
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Windows_Trojan_Remcos_b296e965
Create hunting rule
Author:Elastic Security
Rule name:win_remcos_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.remcos.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

rar c73e3c81e8b239aa9180b85ef86db00e3c8a9ad9c14469de56c273457ef3744e

RemcosRAT

Executable exe cf8056e691bd5d73dbffedb8228a1cb2bee27791633c7cf2114041112f66b93d

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 c73e3c81e8b239aa9180b85ef86db00e3c8a9ad9c14469de56c273457ef3744e
Cape
Cape
https://www.capesandbox.com/analysis/388341/
  
Dropped by
MD5 882eae9db1263720e6642e99db0c3fe9

Comments