🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 daf22d8b8cf3ef343b4d90d6746c42aadacde8a416698c299eb17ae5ebff7705. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 13


Intelligence 13 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: daf22d8b8cf3ef343b4d90d6746c42aadacde8a416698c299eb17ae5ebff7705
SHA3-384 hash: b4c8dc3469d2ada81bd1b2d4f09f092f6665c76297284a85761356367e9c0c9b092787722f64786ce1353a543f3ed434
SHA1 hash: 6861c097a96e715afbcc55edc54f274c39d4aa64
MD5 hash: e9d10a7c59f27bbab0b5fa53a39dcd04
humanhash: colorado-saturn-maine-summer
File name:JAH4ME.exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:2'381'824 bytes
First seen:2022-11-24 13:17:21 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'239 x AgentTesla, 20'489 x Formbook, 12'372 x SnakeKeylogger)
ssdeep 49152:KcvFbr/W6me4u1EjpNem8A68XoMywrYPLTfdAiKbnSAUXBvoJmF:XtRMvZrqrk+XQq
Threatray 2'258 similar samples on MalwareBazaar
TLSH T1BFB54B2907142BE4F132E5470CBD4E6680FA7D162B8ABC9DBC22A4846DF1385DF59BDC
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):PE icon
dhash icon 00870d1848c4cc20 (27 x RemcosRAT, 6 x Formbook, 1 x NanoCore)
Reporter malwarelabnet
Tags:exe remcos RemcosRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
395
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
JAH4ME.exe
Verdict:
Malicious activity
Analysis date:
2022-11-24 13:20:26 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/91a25f36-7878-4154-8177-783689093a1e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/338069/
Detection(s):
SecuriteInfo.com.Win32.PWSX-gen.22481.21564.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Сreating synchronization primitives
Creating a process with a hidden window
Sending a custom TCP request
Creating a file in the %AppData% subdirectories
Unauthorized injection to a recently created process
Creating a file
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
remcos
Link:
https://www.filescan.io/uploads/637f6f0b00c584752ee1b81a/reports/35698f86-e3e0-42e2-9137-1663854c6808/overview
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/c7e2b361-011c-4f89-a117-389944549836
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1120533
Signature
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Encrypted powershell cmdline option found
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Remcos
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 753250 Sample: JAH4ME.exe Startdate: 24/11/2022 Architecture: WINDOWS Score: 100 48 Malicious sample detected (through community Yara rule) 2->48 50 Antivirus detection for URL or domain 2->50 52 Antivirus / Scanner detection for submitted sample 2->52 54 6 other signatures 2->54 7 JAH4ME.exe 1 5 2->7         started        11 Ytlioxexd.exe 2 2->11         started        13 Ytlioxexd.exe 1 2->13         started        process3 file4 36 C:\Users\user\AppData\...\Ytlioxexd.exe, PE32 7->36 dropped 38 C:\Users\...\Ytlioxexd.exe:Zone.Identifier, ASCII 7->38 dropped 40 C:\Users\user\AppData\...\JAH4ME.exe.log, ASCII 7->40 dropped 56 Encrypted powershell cmdline option found 7->56 58 Injects a PE file into a foreign processes 7->58 15 JAH4ME.exe 2 7->15         started        18 powershell.exe 15 7->18         started        60 Antivirus detection for dropped file 11->60 62 Multi AV Scanner detection for dropped file 11->62 64 Machine Learning detection for dropped file 11->64 20 powershell.exe 11->20         started        22 Ytlioxexd.exe 11->22         started        24 powershell.exe 13->24         started        26 Ytlioxexd.exe 13->26         started        28 Ytlioxexd.exe 13->28         started        signatures5 process6 dnsIp7 42 185.206.225.51, 18853 M247GB United Kingdom 15->42 44 10.16.225.165, 18853 unknown unknown 15->44 46 127.0.0.1 unknown unknown 15->46 30 conhost.exe 18->30         started        32 conhost.exe 20->32         started        34 conhost.exe 24->34         started        process8
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/daf22d8b8cf3ef343b4d90d6746c42aadacde8a416698c299eb17ae5ebff7705/
Threat name:
ByteCode-MSIL.Backdoor.Remcos
Create hunting rule
Status:
Malicious
First seen:
2022-11-24 05:19:46 UTC
File Type:
PE (.Net Exe)
Extracted files:
3
AV detection:
23 of 26 (88.46%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3lzc3c4m6pxtio2nsdlhi3ccvlnm32feczuyykm6wf5ol277o4cq._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
1015aaf219bd6c756e9e5224d219ed551795585e383fb4a6d2a566e7c8dabad5
RemcosRAT
346a4ca2e508923bcf0e4c0d73a2ee06d91bd436b8db4981ab9ecb16e6f5110d
RemcosRAT
415f115399ed11ed0e11ebd468d3082bb1d0771c3c663fed23bd481a18a2898f
RemcosRAT
8ca7b7fb5faccbfbb3527570937ccb3b12ab32f95edac422a9f0642f8bbb7802
RemcosRAT
b07f08cbf908eb0d5c93679c8dca8438e4f185a70d675ad79184533dc6b4b262
RemcosRAT
c5fe9955259f76f4b03bd65fd5e146803690d8057d7ef474c3b1b8eec0b1b928
RemcosRAT
e04e4c474ded78364c1f802de5a653e2d495bc1a0ddb78325962778a221970e6
RemcosRAT
eb9f9d5d304acc0c162c922f5a12a80a28e511e536ed3f4b18f7d301a7502640
RemcosRAT
+ 2'248 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:mimi persistence rat
Link:
https://tria.ge/reports/221124-qjx1psaf3w/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Checks computer location settings
Remcos
Malware Config
C2 Extraction:
185.206.225.51:18853
127.0.0.1:18853
10.16.225.165:18853
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/5046367c-ef45-4a63-9dbe-c3c75899a8f5
Unpacked files
SH256 hash:
dbe8feffa5701bc1a977d72e2cc9e1d53b75ca3909cfa41a095fa438ac977417
MD5 hash:
367939b695df3fdec15480c1e2515c25
SHA1 hash:
dc92f04909a550a98db331f90956796f2057c036
Link:
https://www.unpac.me/results/3f0523e5-ed4c-41bb-8cf0-18e69b66838b/
SH256 hash:
cb38815833a6388aacd796ceb5d31605e19f82439cc92277596758bc9c9cbe2b
MD5 hash:
5df81fb50668385b0b2100bfff4b2e46
SHA1 hash:
3e79a117f44d4d445d62f3fbfbeca078eeedc8b9
Link:
https://www.unpac.me/results/3f0523e5-ed4c-41bb-8cf0-18e69b66838b/
SH256 hash:
2b6466288e3901d505cb32b4e61640efb75278a30f71752f36fd56326d27ddcf
MD5 hash:
2c8ca1f46500622a894a77ecc627e1f9
SHA1 hash:
025e028ae0b327a623770da45421f842de757eaf
Detections:
Remcos
Create hunting rule
win_remcos_auto
Create hunting rule
Link:
https://www.unpac.me/results/3f0523e5-ed4c-41bb-8cf0-18e69b66838b/
Parent samples :
96c227a95417ea3bb0c39c952b0b0709f62a525340ea402e5b3af59beba3c6ef
daf22d8b8cf3ef343b4d90d6746c42aadacde8a416698c299eb17ae5ebff7705
SH256 hash:
daf22d8b8cf3ef343b4d90d6746c42aadacde8a416698c299eb17ae5ebff7705
MD5 hash:
e9d10a7c59f27bbab0b5fa53a39dcd04
SHA1 hash:
6861c097a96e715afbcc55edc54f274c39d4aa64
Link:
https://www.unpac.me/results/3f0523e5-ed4c-41bb-8cf0-18e69b66838b/
Malware family:
Remcos
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/daf22d8b8cf3/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/daf22d8b8cf3ef343b4d90d6746c42aadacde8a416698c299eb17ae5ebff7705

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/338069/

Comments