MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d500b70f534ef5f6a6b6fc988b8e626b2b722834bf033b301cac1658293b560d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 15


Intelligence 15 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d500b70f534ef5f6a6b6fc988b8e626b2b722834bf033b301cac1658293b560d
SHA3-384 hash: a48ac72b9a8e9c6d2ba923bff799e8d6d447553fdd2ce93444cefd42b6f82580a2a89af9cb5350906d87db00e1274841
SHA1 hash: 4158be90ec72b2d63308b27f58338fb9ab848bdf
MD5 hash: 36aea988e675e9604eb01756069c4d17
humanhash: kitten-leopard-west-quiet
File name:HNN.exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:297'984 bytes
First seen:2022-01-19 15:05:38 UTC
Last seen:2022-01-19 16:37:20 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 6144:nyCLL/bRmgAhVYdCFlm7JJXH9VSPdHhH7jHFwH/CvcgevOhpRRRRRER:nrP/bRmHMYTm7fXdVubbpwfQWkRRRRRM
Threatray 3'957 similar samples on MalwareBazaar
TLSH T1D5540225A2FC8322CDEE0BB97462904417B897976B06E34D57CEB58F2E833435511BBB
Reporter James_inthe_box
Tags:exe RemcosRAT

Intelligence

File Origin
# of uploads :
2
# of downloads :
187
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Malware_ZIP_66f44fb89ceb303890f53198ccdfe09a25509fdcdc116b870275225345e320a7.zip
Verdict:
Malicious activity
Analysis date:
2022-01-19 08:23:15 UTC
Tags:
exploit CVE-2017-11882 loader
Link:
https://app.any.run/tasks/c42a9d6a-b136-4726-9129-8984547856e1

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Remcos
Create hunting rule
Link:
https://www.capesandbox.com/analysis/220672/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.1162.31773.3954.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.PackedNET.1162.24772.32144.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
DNS request
Creating a file
Сreating synchronization primitives
Creating a file in the %AppData% subdirectories
Creating a file in the %temp% directory
Running batch commands
Creating a process with a hidden window
Launching a process
Creating a process from a recently created file
Unauthorized injection to a recently created process
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/61e828e30f8c757253cccc13/reports/c4b06c29-5071-4053-922c-f21340f3c9c3/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
REMCOS
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4d813230-805a-4d0f-a003-876b19920edb
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/923553
Signature
.NET source code contains potential unpacker
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to capture and log keystrokes
Contains functionality to detect virtual machines (IN, VMware)
Contains functionality to inject code into remote processes
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Detected Remcos RAT
Found malware configuration
Installs a global keyboard hook
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses dynamic DNS services
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Yara detected AntiVM3
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 556027 Sample: HNN.exe Startdate: 19/01/2022 Architecture: WINDOWS Score: 100 64 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->64 66 Found malware configuration 2->66 68 Malicious sample detected (through community Yara rule) 2->68 70 9 other signatures 2->70 9 HNN.exe 3 2->9         started        13 remcos.exe 2 2->13         started        15 remcos.exe 2 2->15         started        process3 file4 54 C:\Users\user\AppData\Local\...\HNN.exe.log, ASCII 9->54 dropped 74 Contains functionality to detect virtual machines (IN, VMware) 9->74 76 Contains functionality to steal Chrome passwords or cookies 9->76 78 Contains functionality to capture and log keystrokes 9->78 80 2 other signatures 9->80 17 HNN.exe 1 5 9->17         started        21 remcos.exe 13->21         started        23 remcos.exe 13->23         started        25 remcos.exe 13->25         started        27 remcos.exe 15->27         started        signatures5 process6 dnsIp7 56 192.168.2.1 unknown unknown 17->56 50 C:\Users\user\AppData\Roaming\...\remcos.exe, PE32 17->50 dropped 52 C:\Users\user\...\remcos.exe:Zone.Identifier, ASCII 17->52 dropped 29 cmd.exe 1 17->29         started        file8 process9 signatures10 82 Uses ping.exe to sleep 29->82 84 Uses ping.exe to check the status of other devices and networks 29->84 32 remcos.exe 3 29->32         started        35 PING.EXE 1 29->35         started        38 conhost.exe 29->38         started        process11 dnsIp12 62 Multi AV Scanner detection for dropped file 32->62 40 remcos.exe 1 3 32->40         started        44 remcos.exe 32->44         started        46 remcos.exe 32->46         started        48 remcos.exe 32->48         started        58 127.0.0.1 unknown unknown 35->58 signatures13 process14 dnsIp15 60 newremc22.ddns.net 212.192.246.74, 2717, 49756 RHC-HOSTINGGB Russian Federation 40->60 72 Installs a global keyboard hook 40->72 signatures16
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d500b70f534ef5f6a6b6fc988b8e626b2b722834bf033b301cac1658293b560d/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-01-18 18:37:00 UTC
File Type:
PE (.Net Exe)
Extracted files:
15
AV detection:
19 of 27 (70.37%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2ualod2tj327njvw7smixdtcnmvxekbux4btwma4vqlfqkj3kygq._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
200c65040041056006600f5a6ed2bbc3281a6e440a12d24a84544d65e157288e
RemcosRAT
3f2c710a97bb42579ee2f9956437ff160a68bd787439fbc025ab3d6b46076d34
RemcosRAT
5454ec6037767c7c675551dafd7c023e8bd974f7fce965aa94505b19151895f2
RemcosRAT
5b474ca6fc8158bd6f14d53bca8962f25db3392dfe324f49ddf376610bd785e4
RemcosRAT
5f4e4a43a01b235d781c6888198b18750529dda9fc4727727940115090e06a6d
RemcosRAT
753cc07b3d3e9d5cc44061f9f5b2933d2e1f7f18155f9c17346592e254eab0c2
RemcosRAT
a415a8e3922c0026ce33f3663d90894e209ef6dea4e30de47018cdd58a6b2fbc
RemcosRAT
b9ca965db145fcc16ad0b97a3232fac27d2cdcbce9122a9a2bc613835b490369
RemcosRAT
d72b99be6c28cec8f3672df1ef58a69cb08524e181fb7ba53edbdab73f3ccf44
RemcosRAT
fcdb09f9b63c86b92059cb0c636da21a2daee289a120cff346a7d73b02bdff4e
RemcosRAT
+ 3'947 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:harry persistence rat suricata
Link:
https://tria.ge/reports/220119-sgq6gsahen/
Behaviour
Runs ping.exe
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Checks computer location settings
Loads dropped DLL
Executes dropped EXE
Remcos
suricata: ET MALWARE Remcos RAT Checkin 23
Malware Config
C2 Extraction:
newremc22.ddns.net:2717
Unpacked files
SH256 hash:
706f40859cd3de0725c0c1795e98277d54bbc37ff90fc1e251e2eb99d0e713f0
MD5 hash:
4471b661df152bdc5c7749a8ae412a3b
SHA1 hash:
e1535ca63afd99009ec52aa1435f2ae87639f85c
Detections:
win_remcos_g0
Create hunting rule
win_remcos_auto
Create hunting rule
Link:
https://www.unpac.me/results/2a22c651-f5aa-4c4e-b01b-7b163e350b5d/
Parent samples :
d500b70f534ef5f6a6b6fc988b8e626b2b722834bf033b301cac1658293b560d
6c1e347274ca3a36f91b70a7cc2dd5fa4fdab50e96aaf43cd33a750b9da16184
91a6073fee95df45b5339667b67a48859d5be0e6cf8a8150ec3f448ee101d4a2
0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799
d704dcd5b6dba9ec69ae4e7e1807a1cfc9684b62e39157ef58b5ece3fede7bdf
SH256 hash:
d5f975d2fa03f5478c04c0dff32f6adbfc5e9f43c505d47b85cd1677903e3da2
MD5 hash:
c2060336c4a761ecbfc59cd91adf3d23
SHA1 hash:
ac221414d8737922dab7655fdf40071bdf58fbb1
Link:
https://www.unpac.me/results/2a22c651-f5aa-4c4e-b01b-7b163e350b5d/
SH256 hash:
9f4f8e3d13d9d4857bbd140e506b961ea74dab8f99fb5f3f88b882d43ae4fffa
MD5 hash:
faba15957bcfa3fd584ff7a78b038977
SHA1 hash:
9011c7906e58b90b58735b68a89cc59506a2f1b4
Link:
https://www.unpac.me/results/2a22c651-f5aa-4c4e-b01b-7b163e350b5d/
SH256 hash:
d500b70f534ef5f6a6b6fc988b8e626b2b722834bf033b301cac1658293b560d
MD5 hash:
36aea988e675e9604eb01756069c4d17
SHA1 hash:
4158be90ec72b2d63308b27f58338fb9ab848bdf
Link:
https://www.unpac.me/results/2a22c651-f5aa-4c4e-b01b-7b163e350b5d/
Malware family:
Remcos
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/d500b70f534e/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Remcos
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/d500b70f534ef5f6a6b6fc988b8e626b2b722834bf033b301cac1658293b560d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/220672/
  
URLhaus
https://urlhaus.abuse.ch/url/1989682/

Comments