MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d6ef67304b2eca589df643aa3e30a21ce7b835bb66b0d3856ece4e46e7217d6e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 15


Intelligence 15 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d6ef67304b2eca589df643aa3e30a21ce7b835bb66b0d3856ece4e46e7217d6e
SHA3-384 hash: 13c793c56e17127f6ca06ffbb3460b7ce43917e1d2ed3c79f1a1372661ab7126b94e0e18307c008001aff44a9ed4eb23
SHA1 hash: ed4959f57cb4f06f080ddf6bdfa0622b6623efe1
MD5 hash: 8e0c6b160cf2aa2e894d4d3e4f775887
humanhash: network-delta-fruit-louisiana
File name:file
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:433'664 bytes
First seen:2022-10-27 14:53:04 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash d5baaf7db716df76241a88766114f3b8 (3 x RemcosRAT)
ssdeep 6144:UbfRYSwUv9gMP3+U+hyTqG8ntSxuH1ujujg9BD7a8rfdJ9AOq2CXr93cvK2U:UrRrwU2M3+xGCTQjujgj9U229EU
Threatray 2'076 similar samples on MalwareBazaar
TLSH T1FB949E11B981C432C1B211700E29FB769ABCBD212935597BA3E95D9BFE701C0B73A763
TrID 32.2% (.EXE) Win64 Executable (generic) (10523/12/4)
20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
15.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
13.7% (.EXE) Win32 Executable (generic) (4505/5/1)
6.2% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon c4d48eaa8ad4d4f8 (1'000 x RemcosRAT, 1 x Worm.Ramnit, 1 x Vjw0rm)
Reporter jstrosch
Tags:exe RemcosRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
242
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
remcos
Create hunting rule
ID:
1
File name:
https://codiumsecurity.com/peoplesstubs/
Verdict:
Malicious activity
Analysis date:
2022-09-28 15:00:03 UTC
Tags:
remcos
Link:
https://app.any.run/tasks/09899cf9-d1a6-4624-a2bb-8190998d574f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Remcos
Create hunting rule
Link:
https://www.capesandbox.com/analysis/324942/
Detection(s):
Win.Trojan.Remcos-9841897-0
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a file
Creating a window
Creating a file in the system32 subdirectories
Sending a custom TCP request
Creating a file in the %AppData% subdirectories
Moving a file to the %AppData% subdirectory
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/46006/overview
Behaviour
MalwareBazaar
MeasuringTime
CheckCmdLine
EvasionQueryPerformanceCounter
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
REMCOS
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/63d2cb0a-183f-486a-b3b2-0f4b797d9e34
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/1099471
Behaviour
Behavior Graph:
n/a
Detection:
remcos
Create hunting rule
Link:
https://mwdb.cert.pl/sample/d6ef67304b2eca589df643aa3e30a21ce7b835bb66b0d3856ece4e46e7217d6e/
Threat name:
Win32.Backdoor.Remcos
Create hunting rule
Status:
Malicious
First seen:
2022-09-29 12:59:47 UTC
File Type:
PE (Exe)
Extracted files:
8
AV detection:
23 of 26 (88.46%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=23xwomclf3ffrhpwiovd4mfcdtt3qnn3m2ynhblozzhenzzbpvxa._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
18f51c19c22914e634d9cfcd86018e676e91d1c4a9293c247a3c9da84dce3f60
RemcosRAT
1fbca7154111316e9d34ac02beb2377d20ca8426cc83669c89313a4a83358503
RemcosRAT
7a25e7868a967540a3dc4c8fa89f07444c4b714c4d2f3add235a7f0c33099c57
RemcosRAT
8865c82943ba3a6479fca40222a730e22e3d1cd279c6c6e0915c5c47f893636a
RemcosRAT
b7149d17821e8a67af81dc5cc7d7d09def03d6347e178434ec8923a1fcb74e66
RemcosRAT
bcaf8f9bb1cda543a06ef101b8f4ac8228360400ec35a2ef2fba27b372ba75e7
RemcosRAT
e962f44882a6fc4f5289556b7b0169b24838ea2285cf961b82447ff71ff2dc0d
RemcosRAT
+ 2'066 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:remotehost
Link:
https://tria.ge/reports/221027-r9we8sceer/
Behaviour
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Malware Config
C2 Extraction:
192.168.0.107:2404
Unpacked files
SH256 hash:
d6ef67304b2eca589df643aa3e30a21ce7b835bb66b0d3856ece4e46e7217d6e
MD5 hash:
8e0c6b160cf2aa2e894d4d3e4f775887
SHA1 hash:
ed4959f57cb4f06f080ddf6bdfa0622b6623efe1
Detections:
win_remcos_auto
Create hunting rule
Link:
https://www.unpac.me/results/250186b7-0809-40cd-89de-2a6982da38c3/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d6ef67304b2eca589df643aa3e30a21ce7b835bb66b0d3856ece4e46e7217d6e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Remcos
Create hunting rule
Author:kevoreilly
Description:Remcos Payload
Rule name:REMCOS_RAT_variants
Create hunting rule
Rule name:Windows_Trojan_Remcos_b296e965
Create hunting rule
Author:Elastic Security
Rule name:win_remcos_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.remcos.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RemcosRAT

Executable exe d6ef67304b2eca589df643aa3e30a21ce7b835bb66b0d3856ece4e46e7217d6e

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/324942/

Comments