MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d62eb89c78bac4e922311ddaac060e97a17ef7af8bde84008d6ec43195607c6f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 16


Intelligence 16 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d62eb89c78bac4e922311ddaac060e97a17ef7af8bde84008d6ec43195607c6f
SHA3-384 hash: 600e4b050d49afc72546d51dcca2847c55ebe5859a9f51c44587239af20ecefcc48d01ea7df3f95134a18f1dce396f63
SHA1 hash: 09209a796d48336fed8aa6dd63490133edf3e3ab
MD5 hash: 1d559db083653055d70931df9ba4386c
humanhash: diet-uniform-green-virginia
File name:1d559db083653055d70931df9ba4386c.exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'672'192 bytes
First seen:2023-05-05 12:26:06 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 24576:xP60nw+la4zgaJdYnyb8cdvVa+OQkKUT9d0aSLODQXWrqrKPXLBiJXA:5w+dgOz8aa+OKafyLWQSv7BiJXA
Threatray 1'934 similar samples on MalwareBazaar
TLSH T16175F13256A2BDEDD3AD2CFDE8D215C40CC898F7A27491ACBC8490DBA0A9754DD75CB0
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):PE icon
dhash icon b3b3b371716b93b3 (25 x CryptOne, 12 x RemcosRAT, 6 x RedLineStealer)
Reporter abuse_ch
Tags:exe RAT RemcosRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
254
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
remcos
Create hunting rule
ID:
1
File name:
1d559db083653055d70931df9ba4386c.exe
Verdict:
Malicious activity
Analysis date:
2023-05-05 12:31:55 UTC
Tags:
rat remcos keylogger
Link:
https://app.any.run/tasks/353bfb9a-d8e7-4ec2-8c52-8361ede6583b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Remcos
Create hunting rule
Link:
https://www.capesandbox.com/analysis/386877/
Detection(s):
SecuriteInfo.com.Heur.MSIL.Krypt.11.23811.8873.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Launching a process
Creating a process with a hidden window
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/6454f61732697907fb692f62/reports/f8901c62-3078-4bdd-97ef-8d989d90876f/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/d62eb89c78bac4e922311ddaac060e97a17ef7af8bde84008d6ec43195607c6f
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/f8d95b90-453a-466a-8f57-a14969504842
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1227156
Signature
.NET source code contains potential unpacker
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Contains functionality to bypass UAC (CMSTPLUA)
Contains functionality to modify clipboard data
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Creates an undocumented autostart registry key
Delayed program exit found
Encrypted powershell cmdline option found
Found malware configuration
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Remcos
Uses dynamic DNS services
Writes to foreign memory regions
Yara detected Remcos RAT
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 860118 Sample: IV31Vn51G3.exe Startdate: 05/05/2023 Architecture: WINDOWS Score: 100 34 Found malware configuration 2->34 36 Malicious sample detected (through community Yara rule) 2->36 38 Multi AV Scanner detection for dropped file 2->38 40 9 other signatures 2->40 7 IV31Vn51G3.exe 5 2->7         started        process3 file4 22 C:\Users\user\AppData\...\Bgecsflz.exe, PE32 7->22 dropped 24 C:\Users\...\Bgecsflz.exe:Zone.Identifier, ASCII 7->24 dropped 26 C:\Users\user\AppData\...\IV31Vn51G3.exe.log, ASCII 7->26 dropped 42 Creates an undocumented autostart registry key 7->42 44 Encrypted powershell cmdline option found 7->44 46 Writes to foreign memory regions 7->46 48 2 other signatures 7->48 11 InstallUtil.exe 7->11         started        14 InstallUtil.exe 3 16 7->14         started        18 powershell.exe 16 7->18         started        signatures5 process6 dnsIp7 50 Contains functionality to bypass UAC (CMSTPLUA) 11->50 52 Contains functionality to steal Chrome passwords or cookies 11->52 54 Contains functionality to modify clipboard data 11->54 58 2 other signatures 11->58 30 infoprokapz.ddns.net 45.88.66.87, 49702, 6838 LVLT-10753US Bulgaria 14->30 32 geoplugin.net 178.237.33.50, 49703, 80 ATOM86-ASATOM86NL Netherlands 14->32 28 C:\ProgramData\remcos\logs.dat, data 14->28 dropped 56 Installs a global keyboard hook 14->56 20 conhost.exe 18->20         started        file8 signatures9 process10
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d62eb89c78bac4e922311ddaac060e97a17ef7af8bde84008d6ec43195607c6f/
Threat name:
ByteCode-MSIL.Packed.Generic
Create hunting rule
Status:
Suspicious
First seen:
2023-05-05 12:27:08 UTC
File Type:
PE (.Net Exe)
Extracted files:
16
AV detection:
19 of 24 (79.17%)
Threat level:
  1/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2yxlrhdyxlcosirrdxnkybqos6qx555prppiiaenn3cddflaprxq._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
2010a7e1a136a9881ba4db4beb99088ea77ea2997d36e6d1d16fc696b34fda8b
RemcosRAT
2b4c534df5fe4c7ee7a402f384109cb60b54c7f301ef8644e7b1eba397d89f2b
RemcosRAT
38455251726a64db957d8e30e6c1dc1ca2b10c35691dadbcf3bf8172babe94e3
RemcosRAT
3c2ffc42864aba9e07bb8cd494141ea7125a2d24a8717f0cf0a33da8020dbdfb
RemcosRAT
aa2caafd9a1d53df2112c9081fb5686e04283be0da13d94bacdfc8c9addf0c34
RemcosRAT
b19c0bb20a5fe51658666464950c582cef626cdf1f50bf5c775109a0cf2267db
RemcosRAT
c9ec59e23695adca831f06aca398c511cac81f2fd65c7353f14b4725791ab80a
RemcosRAT
cadf95355bd6ea18fdd3555ea3f85d102f40b3df0dc36b332f9ad8b505105f6e
RemcosRAT
f3e4dd541766cd7a3af91ef964b91ded632f13ebe69bd4fb5eadd563c0207059
RemcosRAT
+ 1'924 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:2nd rat
Link:
https://tria.ge/reports/230505-pmq6wscd2s/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Checks computer location settings
Remcos
Malware Config
C2 Extraction:
infoprokapz.ddns.net:6838
Unpacked files
SH256 hash:
96f5cf068889a07ed6aa2150cd02ca0d50859c3a5a26a3b62e9263c96dbf62b6
MD5 hash:
afad29f230c9cc5c6add8083804a281f
SHA1 hash:
fd571b002dc819c72aeb993f8df37864859836af
Detections:
win_remcos_auto
Create hunting rule
Link:
https://www.unpac.me/results/8f041b17-67e5-49ac-bfee-36c8bd9e6a14/
SH256 hash:
ff8c24bce1eb009f0d5c47a09b96caf02726c285cea0d635082ad4da27e63d1b
MD5 hash:
9d6ec6072ee1814a4a01d1eb3fb67ba1
SHA1 hash:
d0b416de1c900b6bcb35dc182b2e8744f16c3289
Link:
https://www.unpac.me/results/8f041b17-67e5-49ac-bfee-36c8bd9e6a14/
SH256 hash:
90f089e8f9e6d7a3c3aa332eec16397bdec552c4e9b02edb1dc41fe706c056d9
MD5 hash:
2825363c26ada94798e534eeaf8d009b
SHA1 hash:
b1c0c5b766bcc0025ffe3d4719bc10d13bcb0067
Detections:
Remcos
Create hunting rule
win_remcos_auto
Create hunting rule
Link:
https://www.unpac.me/results/8f041b17-67e5-49ac-bfee-36c8bd9e6a14/
SH256 hash:
536c943a78c5f3a422b5fe307188388f87d441eeee631edd1f2617f3130e4c57
MD5 hash:
95392720c0fa14bd13e0e5946ea61e2b
SHA1 hash:
80cc06bbef815d96c6a2f19bff391b56385a6ece
Link:
https://www.unpac.me/results/8f041b17-67e5-49ac-bfee-36c8bd9e6a14/
SH256 hash:
6b8d2a3c24e6d235de510f8ebd2d7d888dfac37b62051529e0f9ef178f16d34e
MD5 hash:
18ac9908ce006315f77429cda17c5052
SHA1 hash:
41f93cc915fa1639670bf69eb6e865f7b8da8a91
Link:
https://www.unpac.me/results/8f041b17-67e5-49ac-bfee-36c8bd9e6a14/
SH256 hash:
d62eb89c78bac4e922311ddaac060e97a17ef7af8bde84008d6ec43195607c6f
MD5 hash:
1d559db083653055d70931df9ba4386c
SHA1 hash:
09209a796d48336fed8aa6dd63490133edf3e3ab
Link:
https://www.unpac.me/results/8f041b17-67e5-49ac-bfee-36c8bd9e6a14/
Malware family:
Remcos
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/d62eb89c78ba/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d62eb89c78bac4e922311ddaac060e97a17ef7af8bde84008d6ec43195607c6f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RemcosRAT

Executable exe d62eb89c78bac4e922311ddaac060e97a17ef7af8bde84008d6ec43195607c6f

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2625200/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/386877/

Comments