MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d0fbaa4e5d7b512cdc4b3b63ddbed59d1cb741f3925381124ee91942ecfdf3a6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d0fbaa4e5d7b512cdc4b3b63ddbed59d1cb741f3925381124ee91942ecfdf3a6
SHA3-384 hash: 7d499c51ec7cc4f026ab137b484be98933d5f0d9c25b510500113a1fcad2e45e3b37556ee0ff4b11bac88e38c22ee735
SHA1 hash: fb0fb6f73019f645aaaa6b7ffd40c2d9df39e5de
MD5 hash: 8333ca39ae364a0c977dc6d304495a05
humanhash: mountain-two-football-red
File name:User Help Services.exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:3'727'352 bytes
First seen:2021-01-05 22:40:39 UTC
Last seen:2021-01-06 00:58:32 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 08e8a4b900d8951ca85cb9b585003e3f (1 x RemcosRAT)
ssdeep 49152:EuMmOYYzaSu4j0d9h121TP6yTQtT4CuDFX:hMmOm12V6ZwJX
Threatray 1'338 similar samples on MalwareBazaar
TLSH A1069D23B249543EC06B0636053BA675D93EFF512A12CDA7A3F02C5CAF76580753A39B
Reporter o2genum
Tags:exe RemcosRAT signed

Intelligence

File Origin
# of uploads :
2
# of downloads :
216
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
User Help Services.exe
Verdict:
Malicious activity
Analysis date:
2021-01-05 22:41:46 UTC
Tags:
rat remcos
Link:
https://app.any.run/tasks/f4fadf5c-e2a1-49df-b04f-bca82964d1f1

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/110628/
Detection(s):
PUA.Win.Adware.Graftor-6878643-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Enabling the 'hidden' option for files in the %temp% directory
Moving a file to the %temp% directory
Creating a window
Launching a process
Transferring files using the Background Intelligent Transfer Service (BITS)
DNS request
Sending a custom TCP request
Creating a file in the %temp% directory
Sending a UDP request
Unauthorized injection to a system process
Forced shutdown of a system process
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/574679
Signature
Allocates memory in foreign processes
Contains functionality to capture and log keystrokes
Contains functionality to inject code into remote processes
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Detected Remcos RAT
DLL planting / hijacking vulnerabilities found
EXE planting / hijacking vulnerabilities found
Hijacks the control flow in another process
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Uses nslookup.exe to query domains
Writes to foreign memory regions
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 336397 Sample: User Help Services.exe Startdate: 05/01/2021 Architecture: WINDOWS Score: 100 30 Malicious sample detected (through community Yara rule) 2->30 32 Detected Remcos RAT 2->32 34 Yara detected Remcos RAT 2->34 36 Uses nslookup.exe to query domains 2->36 7 User Help Services.exe 2->7         started        process3 signatures4 38 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 7->38 40 Hijacks the control flow in another process 7->40 42 Uses nslookup.exe to query domains 7->42 44 3 other signatures 7->44 10 nslookup.exe 1 7->10         started        process5 signatures6 46 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 10->46 48 Hijacks the control flow in another process 10->48 50 Writes to foreign memory regions 10->50 52 Maps a DLL or memory area into another process 10->52 13 cmd.exe 2 13 10->13         started        18 conhost.exe 10->18         started        process7 dnsIp8 28 95.154.196.12, 49778, 5851 IOMART-ASGB United Kingdom 13->28 20 C:\Users\user\AppData\Roaming\...\vmtools.exe, PE32 13->20 dropped 22 C:\Users\user\AppData\...\libcrypto-1_1.dll, PE32 13->22 dropped 24 C:\Users\user\AppData\Local\...\cghelp.dll, PE32 13->24 dropped 26 C:\Users\user\AppData\...\RuntimeBroker.exe, PE32 13->26 dropped 54 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 13->54 56 Contains functionality to steal Chrome passwords or cookies 13->56 58 Contains functionality to capture and log keystrokes 13->58 60 4 other signatures 13->60 file9 signatures10
Detection:
remcos
Create hunting rule
Link:
https://mwdb.cert.pl/sample/d0fbaa4e5d7b512cdc4b3b63ddbed59d1cb741f3925381124ee91942ecfdf3a6/
Threat name:
Win32.Trojan.GenCBL
Create hunting rule
Status:
Malicious
First seen:
2021-01-05 22:41:05 UTC
AV detection:
10 of 29 (34.48%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
00a43037570aef0f977589fa679bf79627d04890fabfca6c19ae2c2f851ef289
RemcosRAT
17a87ce9f1b198eb1dacc4dde36af67169515d41b322d6bcbaf1861f2d812d39
RemcosRAT
44eb61ad9603cc802e8a59f356dadedf4be9dc315862a9bb2eddec1bcc9288a8
RemcosRAT
46f9b3a73b2ef17c7ace714e6b69b02e444096fb395d85e3b3220ed13d060a48
RemcosRAT
4f718a40662228b1b5efca4664eb07f6d1918b62bc8b29598410d1dc5bb76c70
RemcosRAT
9502b93f782ae19b93623605f74ebc2ee277a453ecd2286ef990d62c28a601e6
RemcosRAT
98d8bbdf43367821e74fd0c26f5bdda07fe9a750476cce1bb0df88c5aa18b745
RemcosRAT
bc8513a74ddfc1a9a78fbdbf39d90a61d59819dfb116846daf730693622c3c69
RemcosRAT
be9005c3def853773256e54e0d8f307a7cd323fa0e86b4691c6e8619b9632afd
RemcosRAT
d4acc0dd3b974dde3fce2ec192c8013e8ec975a71cd6ea9d805cc1992a5930ec
RemcosRAT
+ 1'328 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos rat
Link:
https://tria.ge/reports/210105-rhryqwvmls/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Drops file in Windows directory
Blocklisted process makes network request
Remcos
Malware Config
C2 Extraction:
95.154.196.12:5851
Unpacked files
SH256 hash:
d0fbaa4e5d7b512cdc4b3b63ddbed59d1cb741f3925381124ee91942ecfdf3a6
MD5 hash:
8333ca39ae364a0c977dc6d304495a05
SHA1 hash:
fb0fb6f73019f645aaaa6b7ffd40c2d9df39e5de
Link:
https://www.unpac.me/results/f8b94f21-9ebb-420a-b7b3-84d67dcb0f68/
SH256 hash:
c7fbdc61eb62c05e40295617e2db75877672931f751a770d2629e6eab6075f2c
MD5 hash:
abf6c724b20844d5b0073988a58faf1e
SHA1 hash:
7a8269d5b2ae623f8148ce9863f48f7e12ce036b
Link:
https://www.unpac.me/results/f8b94f21-9ebb-420a-b7b3-84d67dcb0f68/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Backdoor
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d0fbaa4e5d7b512cdc4b3b63ddbed59d1cb741f3925381124ee91942ecfdf3a6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_KB_CERT_56fff139df5ae7e788e5d72196dd563a
Create hunting rule
Author:ditekSHen
Description:Detects executables signed with stolen, revoked or invalid certificates

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RemcosRAT

Executable exe d0fbaa4e5d7b512cdc4b3b63ddbed59d1cb741f3925381124ee91942ecfdf3a6

(this sample)

  
Link
https://www.coin-tradeandmine.com/display-driver-uninstaller-18-0-3-4/
anyrun
any.run
https://app.any.run/tasks/2d2cbb7e-eef5-421b-8caa-802e6693b46b
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/110628/

Comments