MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d56df9be7fc5ff907c8e58dc441a31bc7d75c354d83e96ba814e69138929583b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 18


Intelligence 18 IOCs YARA 23 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d56df9be7fc5ff907c8e58dc441a31bc7d75c354d83e96ba814e69138929583b
SHA3-384 hash: 8124e7ed7046dbd6321558a69302404e913961ecbfcdf66e92d961b8c8f1dead34e31f55c572f73c01567ccc434d487f
SHA1 hash: e9d4e908c6a02705e6fb53435426743344d898ca
MD5 hash: 5451ca09b94ddeafc4e206bbc85637ad
humanhash: colorado-orange-golf-lamp
File name:Reverser Details.exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:964'096 bytes
First seen:2025-05-15 12:52:13 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'468 x Formbook, 12'206 x SnakeKeylogger)
ssdeep 12288:gbv79FvQ5OKdMrCIT3ooz+IbTSc5OfNq2Epdgk8aYH65gSFcKSlr8pbgK4aA3X/j:WpTYoznTSNNq24gn6zCK4W4n3WZpvu
TLSH T10D2512252265C907D4A21FB809B2E3BC5739AD8DE601C7179FE97CEB7E7B70018543A2
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
dhash icon 8e32336969330f08 (3 x MassLogger, 3 x SnakeKeylogger, 1 x AgentTesla)
Reporter James_inthe_box
Tags:exe RemcosRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
508
Origin country :
US US
Vendor Threat Intelligence
Malware family:
remcos
Create hunting rule
ID:
1
File name:
Reverser Details.exe
Verdict:
Malicious activity
Analysis date:
2025-05-15 12:57:27 UTC
Tags:
rat remcos remote netreactor
Link:
https://app.any.run/tasks/2966af7a-fa3c-4818-afbc-7d15041cec69

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Win32.MalwareX-gen.30134.31100.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
90.2%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6825e4c0e16384d6a704ab79
Tags:
remcos virus micro msil
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Сreating synchronization primitives
Connection attempt
Sending a custom TCP request
DNS request
Sending an HTTP GET request
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
obfuscated packed packed packer_detected remcos
Link:
https://www.filescan.io/uploads/6825e388c609634bd7c38940/reports/92c00a55-45c1-4820-a870-a90e57cdb495/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/d56df9be7fc5ff907c8e58dc441a31bc7d75c354d83e96ba814e69138929583b
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4f345a14-8b20-4c2e-9bba-15bf2482c9ac
Result
Threat name:
Remcos, PureLog Stealer
Create hunting rule
Detection:
malicious
Classification:
rans.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1690814
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
C2 URLs / IPs found in malware configuration
Contains functionality to register a low level keyboard hook
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Contains functionalty to change the wallpaper
Delayed program exit found
Detected Remcos RAT
Found malware configuration
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sigma detected: Remcos
Suricata IDS alerts for network traffic
Yara detected AntiVM3
Yara detected PureLog Stealer
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/d56df9be7fc5ff907c8e58dc441a31bc7d75c354d83e96ba814e69138929583b
Detection:
remcos
Create hunting rule
Link:
https://mwdb.cert.pl/sample/d56df9be7fc5ff907c8e58dc441a31bc7d75c354d83e96ba814e69138929583b/
Threat name:
ByteCode-MSIL.Trojan.MassLogger
Create hunting rule
Status:
Malicious
First seen:
2025-05-15 04:30:20 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
18 of 24 (75.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2vw7tpt7yx7za7eoldoeigrrxr6xlq2u3a7jnoubjzurhcjjla5q._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
unc_loader_037
Create hunting rule
Similar samples:
error
RemcosRAT
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:remotehost discovery rat
Link:
https://tria.ge/reports/250515-p3672sw1bx/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Remcos
Remcos family
Malware Config
C2 Extraction:
127.0.0.1:51010
196.251.92.49:51010
oni17.duckdns.org:51010
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/4ad31b9b-28d6-4805-88a8-681f3b6f706a
Unpacked files
SH256 hash:
d56df9be7fc5ff907c8e58dc441a31bc7d75c354d83e96ba814e69138929583b
MD5 hash:
5451ca09b94ddeafc4e206bbc85637ad
SHA1 hash:
e9d4e908c6a02705e6fb53435426743344d898ca
Link:
https://www.unpac.me/results/19e13454-c063-4404-a5a7-107c890b0ebb/
SH256 hash:
0656f59c9e7cfa07d64cf4cd7d85ebd9b4399893cc853f3d1d37cca622d1f815
MD5 hash:
e4a8fe009b340647108a98105600f476
SHA1 hash:
03193855202feecd4bc542876855e706a243f13b
Link:
https://www.unpac.me/results/19e13454-c063-4404-a5a7-107c890b0ebb/
SH256 hash:
999dfac280bb21991b629378ca9c7c4e3a63a4cf4f97973b75549a4a81ec9694
MD5 hash:
d20b2948c6e1198ca8375e381216ff26
SHA1 hash:
8fea7c76b81a130b22c4f61164d91f83588848b6
Detections:
win_remcos_w0
Create hunting rule
win_remcos_auto
Create hunting rule
Remcos
Create hunting rule
malware_windows_remcos_rat
Create hunting rule
win_remcos_rat_unpacked
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer
Create hunting rule
Link:
https://www.unpac.me/results/19e13454-c063-4404-a5a7-107c890b0ebb/
Parent samples :
ba1b869e5e44cc25d8128cd5f25bf37b3bdfc986b1d74cbc506b2cc129f308a1
d56df9be7fc5ff907c8e58dc441a31bc7d75c354d83e96ba814e69138929583b
c66005d3c7cd89f90c4280c7e99d6cacb96519fe21e3bdf72fd4c9223a27f8d5
SH256 hash:
e177916e5ddad24a1e3624692971ef7623e1ffc251c85ec3a5bab2af3dd36c3c
MD5 hash:
d25d82600ce6ccecb219b8cb4dbd7580
SHA1 hash:
a4240fc257f51e7c955d7921e7bfe0016d9ee312
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/19e13454-c063-4404-a5a7-107c890b0ebb/
Malware family:
zgRAT
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/d56df9be7fc5/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d56df9be7fc5ff907c8e58dc441a31bc7d75c354d83e96ba814e69138929583b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:iexplorer_remcos
Create hunting rule
Author:iam-py-test
Description:Detect iexplorer being taken over by Remcos
Rule name:INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer
Create hunting rule
Author:ditekSHen
Description:detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:Remcos
Create hunting rule
Author:kevoreilly
Description:Remcos Payload
Rule name:REMCOS_RAT_variants
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Windows_Trojan_Remcos_b296e965
Create hunting rule
Author:Elastic Security
Reference:https://www.elastic.co/security-labs/exploring-the-ref2731-intrusion-set
Rule name:win_remcos_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.remcos.
Rule name:win_remcos_rat_unpacked
Create hunting rule
Author:Matthew @ Embee_Research
Description:Detects strings present in remcos rat Samples.
Rule name:win_remcos_w0
Create hunting rule
Author:Matthew @ Embee_Research
Description:Detects strings present in remcos rat Samples.
Rule name:yarahub_win_remcos_rat_unpacked_aug_2023
Create hunting rule
Author:Matthew @ Embee_Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

Executable exe d56df9be7fc5ff907c8e58dc441a31bc7d75c354d83e96ba814e69138929583b

(this sample)

  
Delivery method
Distributed via e-mail attachment

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (GUARD_CF)high

Comments