MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 da3b4c6a3fc81e733843987e557efb53beab50fa9ad528aa1a0d7a0f0e1c6e94. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 11


Intelligence 11 IOCs YARA 9 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: da3b4c6a3fc81e733843987e557efb53beab50fa9ad528aa1a0d7a0f0e1c6e94
SHA3-384 hash: 39cbb38e2ce0415ab97d75d5ece42ab014ba4969e110abd732dd0b8dc058332802b4eefbe666ce53b2e3837957381402
SHA1 hash: 50f2d92f29a6189ec28429d38e8ed01f2d6445d6
MD5 hash: 4568267da235d998580cfd9d8b828715
humanhash: high-california-king-mike
File name:4568267da235d998580cfd9d8b828715
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:718'848 bytes
First seen:2021-09-24 07:28:00 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 9a7ebf1a69de9b324d0d1f73a7d054a0 (6 x RemcosRAT, 1 x Formbook)
ssdeep 12288:mftAn+lE3hGAJNmUaxoSThjcymQgMM4PW:4uwEwomU1SFABD
Threatray 431 similar samples on MalwareBazaar
TLSH T133E46DB5AB90443FF2320A38DCCA6342319F7D617DB1EC4125B97A5B7725A81782E1E3
File icon (PE):PE icon
dhash icon c4dcf8c6d6d0c8d4 (21 x RemcosRAT, 3 x Formbook, 1 x AveMariaRAT)
Reporter zbetcheckin
Tags:32 exe RemcosRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
143
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
CTI_Remittance _Note.xls
Verdict:
Malicious activity
Analysis date:
2021-09-23 22:35:00 UTC
Tags:
macros macros-on-open rat remcos loader
Link:
https://app.any.run/tasks/715338b6-2cd8-4482-9f53-d39e78793f0a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Remcos
Create hunting rule
Link:
https://www.capesandbox.com/analysis/191075/
Detection(s):
SecuriteInfo.com.Variant.Zusy.401770.18517.18716.UNOFFICIAL
Create hunting rule

Malware family:
Remcos RAT
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/6b11bdb1-c521-4c80-a4e8-865600fe0282
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/857141
Signature
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Contains functionality to steal Firefox passwords or cookies
Creates a thread in another existing process (thread injection)
Delayed program exit found
Detected Remcos RAT
Found malware configuration
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: WScript or CScript Dropper
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file access)
Writes to foreign memory regions
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 489576 Sample: ZJYhnDLhwa Startdate: 24/09/2021 Architecture: WINDOWS Score: 100 57 trapboijiggy.dvrlists.com 2->57 59 ic-54113400-0a7b2f-windowsupdate48.s.loris.llnwd.net 2->59 79 Found malware configuration 2->79 81 Malicious sample detected (through community Yara rule) 2->81 83 Multi AV Scanner detection for submitted file 2->83 85 5 other signatures 2->85 9 ZJYhnDLhwa.exe 1 23 2->9         started        14 Ykpsyzz.exe 14 2->14         started        16 Ykpsyzz.exe 17 2->16         started        signatures3 process4 dnsIp5 65 sn-files.fe.1drv.com 9->65 67 onedrive.live.com 9->67 69 l5celg.sn.files.1drv.com 9->69 55 C:\Users\Public\Libraries\...\Ykpsyzz.exe, PE32 9->55 dropped 95 Writes to foreign memory regions 9->95 97 Creates a thread in another existing process (thread injection) 9->97 99 Injects a PE file into a foreign processes 9->99 18 logagent.exe 5 2 9->18         started        23 cmd.exe 1 9->23         started        25 cmd.exe 1 9->25         started        71 sn-files.fe.1drv.com 14->71 75 2 other IPs or domains 14->75 101 Multi AV Scanner detection for dropped file 14->101 27 mobsync.exe 14->27         started        73 sn-files.fe.1drv.com 16->73 77 2 other IPs or domains 16->77 29 mobsync.exe 16->29         started        file6 signatures7 process8 dnsIp9 61 trapboijiggy.dvrlists.com 31.3.152.100, 49746, 49747, 49748 ALTUSNL Sweden 18->61 53 C:\Users\user\AppData\Local\Temp\uocdi.vbs, data 18->53 dropped 87 Contains functionality to inject code into remote processes 18->87 89 Contains functionality to steal Firefox passwords or cookies 18->89 91 Injects a PE file into a foreign processes 18->91 93 Delayed program exit found 18->93 31 logagent.exe 1 18->31         started        34 logagent.exe 2 18->34         started        37 logagent.exe 1 18->37         started        39 wscript.exe 18->39         started        41 reg.exe 1 23->41         started        43 conhost.exe 23->43         started        45 cmd.exe 1 25->45         started        47 conhost.exe 25->47         started        file10 signatures11 process12 dnsIp13 103 Tries to steal Instant Messenger accounts or passwords 31->103 105 Tries to steal Mail credentials (via file access) 31->105 63 192.168.2.1 unknown unknown 34->63 107 Tries to harvest and steal browser information (history, passwords, etc) 34->107 49 conhost.exe 41->49         started        51 conhost.exe 45->51         started        signatures14 process15
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/da3b4c6a3fc81e733843987e557efb53beab50fa9ad528aa1a0d7a0f0e1c6e94/
Threat name:
Win32.Trojan.Woreflint
Create hunting rule
Status:
Malicious
First seen:
2021-09-24 07:28:14 UTC
AV detection:
21 of 45 (46.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3i5uy2r7zaphgocdtb7fk7x3ko7kwuh2tlksrkq2bv5a6dq4n2ka._file
Verdict:
malicious
Similar samples:
03811a474b07747d26379d33ee6788366f0d49bf993334d16607b361093463af
RemcosRAT
198a6c69303e222c1e37be51ff9cf68615b4879fb2b152f96aad90daf49c7df1
RemcosRAT
1ddb357041ae22e5c39f309d8432bf9b64e5b07ee9fcf578b7d94543005714fa
RemcosRAT
27bc88fd389ded5b1102d7ef23245aceeb4a516c7291afc954abb876898aa42f
RemcosRAT
4c74f4542101eb419934b0d6fb2765e688314ef1edcd7cf41203d6d3935eef98
RemcosRAT
7ede77932ce7a1fb54f227934c436ce1d0f746efce80e66a7664a4f7bfc909cf
RemcosRAT
8bc32885f532e286073afa7781733d97338f3bab7b22f55680b38fe1926d103b
RemcosRAT
a1adbdad4e1d0b04ddbac043a174b0b9e2731402fd9422085243c32c8e575fdf
RemcosRAT
a3aab02445dfa2ff67c27a8965fb2263965c2ad3f31475e6b6a4459b5c191827
RemcosRAT
b6788527f99a436b0e8925eb14c8800ced61fd406edd4182aa00072b3f74f39e
RemcosRAT
+ 421 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:octopus persistence rat
Link:
https://tria.ge/reports/210924-japveagce2/
Behaviour
Modifies registry key
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Adds Run key to start application
Remcos
Malware Config
C2 Extraction:
trapboijiggy.dvrlists.com:54614
Unpacked files
SH256 hash:
18498f5add7c31c1af213a720891708124ce271e4a1f4eef7427ff9ceff44767
MD5 hash:
af315fe318bcbca468841006ccc57e0a
SHA1 hash:
9b18984c1d4fcafc7bde26250a937aff6c41a375
Link:
https://www.unpac.me/results/db6af09c-fc17-44ff-b039-0cfde8c48f92/
SH256 hash:
da3b4c6a3fc81e733843987e557efb53beab50fa9ad528aa1a0d7a0f0e1c6e94
MD5 hash:
4568267da235d998580cfd9d8b828715
SHA1 hash:
50f2d92f29a6189ec28429d38e8ed01f2d6445d6
Link:
https://www.unpac.me/results/db6af09c-fc17-44ff-b039-0cfde8c48f92/
Malware family:
Remcos
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/da3b4c6a3fc8/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.64
Link:
https://yomi.yoroi.company/submissions/da3b4c6a3fc81e733843987e557efb53beab50fa9ad528aa1a0d7a0f0e1c6e94

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_RemcosRAT
Create hunting rule
Author:abuse.ch
Rule name:INDICATOR_EXE_Packed_MPress
Create hunting rule
Author:ditekSHen
Description:Detects executables built or packed with MPress PE compressor
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_Referenfces_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_UACBypass_EnvVarScheduledTasks
Create hunting rule
Author:ditekSHen
Description:detects Windows exceutables potentially bypassing UAC (ab)using Environment Variables in Scheduled Tasks
Rule name:INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer
Create hunting rule
Author:ditekSHen
Description:detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Rule name:Remcos
Create hunting rule
Author:kevoreilly
Description:Remcos Payload
Rule name:remcos_rat
Create hunting rule
Author:jeFF0Falltrades
Rule name:REMCOS_RAT_variants
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RemcosRAT

Executable exe da3b4c6a3fc81e733843987e557efb53beab50fa9ad528aa1a0d7a0f0e1c6e94

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1641956/
Cape
Cape
https://www.capesandbox.com/analysis/191075/

Comments


Avatar
zbet commented on 2021-09-24 07:28:02 UTC

url : hxxp://192.210.214.221/escrow.exe