MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cfef9f30f8da5f456957bf769a949b0b0f7ce09cee85c13f5538cf97c7733213. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 9


Intelligence 9 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cfef9f30f8da5f456957bf769a949b0b0f7ce09cee85c13f5538cf97c7733213
SHA3-384 hash: ca5725a09f2fcbda406373341bf80a0f8552450c35a9227964b3fa3aec63b8b556d0e812a400a086b7c84010a509ca92
SHA1 hash: 82cb1b9e60a1a5c15264f31f070052f944a60562
MD5 hash: dd1fe5ff1b29ab6a49409f84862b522b
humanhash: quiet-jersey-nevada-nuts
File name:dd1fe5ff1b29ab6a49409f84862b522b.exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:948'224 bytes
First seen:2021-02-17 06:53:15 UTC
Last seen:2021-02-17 08:28:46 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'743 x AgentTesla, 19'608 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 24576:b7qF3YD6Z7iYtU+wkxT6RfAhZK1H4S1hdsqdkmj:SieZ7iYtT6RCK1JCqemj
Threatray 243 similar samples on MalwareBazaar
TLSH B815CF3267086F5CF53CF33941291518ABF5F84AE321EE9D3EDE85DA082AE04D765623
Reporter abuse_ch
Tags:exe RAT RemcosRAT

Intelligence

File Origin
# of uploads :
2
# of downloads :
119
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/117493/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.543.10481.27716.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
rans.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/609863
Signature
C2 URLs / IPs found in malware configuration
Contains functionality to capture and log keystrokes
Contains functionality to inject code into remote processes
Contains functionality to register a low level keyboard hook
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Contains functionalty to change the wallpaper
Delayed program exit found
Detected Remcos RAT
Found malware configuration
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sigma detected: Remcos
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected AntiVM_3
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Download SVG
Detection:
remcos
Create hunting rule
Link:
https://mwdb.cert.pl/sample/cfef9f30f8da5f456957bf769a949b0b0f7ce09cee85c13f5538cf97c7733213/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-02-16 23:31:58 UTC
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=z7xz6mhy3jpuk2kxx53jvfe3bmhxzye452c4cp2vhdhzpr3tgijq._file
Verdict:
suspicious
Similar samples:
4621cbd0cbfaff656d38b7fcc28ef37974734773e822d6812fb927c49f9cc5ce
RemcosRAT
5528ee96b8cefda8ec99999701a1673fb0dff17a8e603f2c8ccd3abac08f7489
RemcosRAT
6ee61893309dd1379d78ad9b04f5c3c5a5b733af82bf64c3dfe28ff6f6d147be
RemcosRAT
7ffcfe208773bc49ef7a0e832fe117592b8eaf83484ebc9cfe9c64eb354aadec
RemcosRAT
80678f73b6527356c0abcce6730e0304e1697e8f81c566d659fdd997acd33543
RemcosRAT
a710f59d3a9366dcac9bf7ead6fc0382b72373fe55e97bc32e3149960ed41bea
RemcosRAT
e5ea618e1c51b6f724e1527d81465fb53693449199b768bacc62d0caca5c1fbc
RemcosRAT
e8de71e3b5cfef776bb7435eea6535a455f3b2cb978a24f11b3f78bbe9e6a3e9
RemcosRAT
f0e5f98041b2aa53b523ff0b00e9ed45356b58406c3fbfd79fc2caa459641ecb
RemcosRAT
f1fa8c7e3ec0184ecbb89e2dd8554d4ab80391d44216d6480762cb14d03008ae
RemcosRAT
+ 233 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos rat upx
Link:
https://tria.ge/reports/210217-sjab5saz52/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
UPX packed file
Remcos
Unpacked files
SH256 hash:
b2499a2af35b550fbe7f541a14ff1225e1202324f351eecf85de6c8e9fc7c27c
MD5 hash:
5e732e4265622675313195dead01047e
SHA1 hash:
359c710a93c2f58cdc2a45de8dd48a6884a70645
Link:
https://www.unpac.me/results/f05acd91-c1ea-481e-a627-edfb870824dc/
SH256 hash:
cfef9f30f8da5f456957bf769a949b0b0f7ce09cee85c13f5538cf97c7733213
MD5 hash:
dd1fe5ff1b29ab6a49409f84862b522b
SHA1 hash:
82cb1b9e60a1a5c15264f31f070052f944a60562
Link:
https://www.unpac.me/results/f05acd91-c1ea-481e-a627-edfb870824dc/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/cfef9f30f8da5f456957bf769a949b0b0f7ce09cee85c13f5538cf97c7733213

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_RemcosRAT
Create hunting rule
Author:abuse.ch
Rule name:Chrome_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Chrome in files like avemaria
Rule name:INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer
Create hunting rule
Author:ditekSHen
Description:detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Rule name:Keylog_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Contains Keylog
Rule name:Parallax
Create hunting rule
Author:@bartblaze
Description:Identifies Parallax RAT.
Rule name:remcos_rat
Create hunting rule
Author:jeFF0Falltrades
Rule name:REMCOS_RAT_variants
Create hunting rule
Rule name:suspicious_packer_section
Create hunting rule
Author:@j0sm1
Description:The packer/protector section names/keywords
Reference:http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RemcosRAT

Executable exe cfef9f30f8da5f456957bf769a949b0b0f7ce09cee85c13f5538cf97c7733213

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1002465/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/117493/

Comments