🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 de91068b93c96919eee2ea1aea8cced755acec6a366fa94bbeceb2c6d5d5f6b2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: de91068b93c96919eee2ea1aea8cced755acec6a366fa94bbeceb2c6d5d5f6b2
SHA3-384 hash: 4f6fa3aee81482a03fe0b7e5804d24d54092dff56abeef207bf66ec8b2cb2efb40dd0e9ad58633cbf87b7fc3f0e1ab0a
SHA1 hash: f0e4272bc4af3c7a7e9484aa3686d716f67a5eb1
MD5 hash: f0ed47ed618351013607b579984864d2
humanhash: uranus-march-shade-equal
File name:root231,pdf.exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'423'872 bytes
First seen:2021-01-28 12:02:34 UTC
Last seen:2021-01-28 12:15:41 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 3d95adbf13bbe79dc24dccb401c12091 (881 x AgentTesla, 737 x FormBook, 236 x SnakeKeylogger)
ssdeep 24576:2tb20pkaCqT5TBWgNQ7aka2w6kVmnYcQMPfaYOtQY6A:jVg5tQ7aAQXYq5
Threatray 1'017 similar samples on MalwareBazaar
TLSH FA65D05363DE82A1CB7162B3B9157742AF7F683506B4B46B2FD80D3CE921172421EA73
Reporter uTMegadine
Tags:RAT remcos RemcosRAT

Intelligence

File Origin
# of uploads :
3
# of downloads :
162
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
advapi32.exe.exe
Verdict:
Malicious activity
Analysis date:
2021-01-27 15:19:46 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/2fb8ca3b-9fc4-4ac7-9b22-f91397f2e870

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/114219/
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/592826
Signature
AutoIt script contains suspicious strings
Binary is likely a compiled AutoIt script file
Contains functionality to capture and log keystrokes
Contains functionality to inject code into remote processes
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Detected Remcos RAT
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Drops script at startup location
Sigma detected: Remcos
Uses dynamic DNS services
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 345457 Sample: root231,pdf.exe Startdate: 28/01/2021 Architecture: WINDOWS Score: 100 37 movement2020.ddns.net 2->37 43 Malicious sample detected (through community Yara rule) 2->43 45 Multi AV Scanner detection for submitted file 2->45 47 Detected Remcos RAT 2->47 49 6 other signatures 2->49 8 root231,pdf.exe 4 2->8         started        12 wscript.exe 1 2->12         started        signatures3 process4 file5 31 C:\Users\user\...\advapi32.exe.exe, PE32 8->31 dropped 33 C:\Users\user\AppData\Roaming\...\.url, MS 8->33 dropped 59 Contains functionality to steal Chrome passwords or cookies 8->59 61 Contains functionality to capture and log keystrokes 8->61 63 Contains functionality to inject code into remote processes 8->63 65 2 other signatures 8->65 14 root231,pdf.exe 2 3 8->14         started        18 root231,pdf.exe 8->18         started        20 root231,pdf.exe 8->20         started        22 root231,pdf.exe 8->22         started        24 advapi32.exe.exe 12->24         started        signatures6 process7 dnsIp8 39 movement2020.ddns.net 194.5.98.14, 49722, 49724, 49729 DANILENKODE Netherlands 14->39 41 192.168.2.1 unknown unknown 14->41 35 C:\Users\user\AppData\Roaming\...\logs.dat, ASCII 14->35 dropped 51 Multi AV Scanner detection for dropped file 24->51 53 Binary is likely a compiled AutoIt script file 24->53 55 Contains functionality to steal Chrome passwords or cookies 24->55 57 3 other signatures 24->57 27 audiodg.exe 24->27         started        29 advapi32.exe.exe 24->29         started        file9 signatures10 process11
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/de91068b93c96919eee2ea1aea8cced755acec6a366fa94bbeceb2c6d5d5f6b2/
Threat name:
Win32.Backdoor.Remcos
Create hunting rule
Status:
Malicious
First seen:
2021-01-22 10:05:37 UTC
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=32iqnc4tzfurt3xc5inovdgo25k2z3dkgzx2ss56z2zmnvov62za._file
Verdict:
malicious
Similar samples:
06bdfeb06913135fc27119ebf2c896d2ff3d30e05a1cbd53ad1d0f632a4fba46
RemcosRAT
0a44ee4a63f01378570de7668ee2daa17534d296a6ff2c45bc14d8f9b07bb837
RemcosRAT
136c0ea1bd536ac388d809f3d1f7c01be867a72a77b6b71df7b2d04ae21e3064
RemcosRAT
2929bd7e338ae0270746e4b60faa44c0f5d3d34c4d166964ce013100bafbf1a3
RemcosRAT
48f69c4f0432c9552fff3e4bd5274751ecd529365ccee42c7a3b5f3bbc83ffe5
RemcosRAT
513e797eab500315caf66ea8f8fd8ad7aa879368533eff217af06cfdec1c04d6
RemcosRAT
c68c5407761a171701a85db8af4dcc308e667adaf26062bd5f11986162f438df
RemcosRAT
cca90e3d9da209fea67333dafd2d7882f498f1c0023432f0ab6f05a3ca430b19
RemcosRAT
d9d166ad30417f3158f7228c54985f97fe502523f910f14fbc5f7fb729c85e56
RemcosRAT
db183fbb41e6ac88f64e72c8b5b21ff971530789ff2ff1df1f5a8d8827b4ded6
RemcosRAT
+ 1'007 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos rat
Link:
https://tria.ge/reports/210128-43sfvx59ex/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Drops startup file
Remcos
Malware Config
C2 Extraction:
movement2020.ddns.net:6735
Unpacked files
SH256 hash:
de91068b93c96919eee2ea1aea8cced755acec6a366fa94bbeceb2c6d5d5f6b2
MD5 hash:
f0ed47ed618351013607b579984864d2
SHA1 hash:
f0e4272bc4af3c7a7e9484aa3686d716f67a5eb1
Link:
https://www.unpac.me/results/d1a6c727-f3f5-416d-945c-1004a8aa98d9/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/de91068b93c96919eee2ea1aea8cced755acec6a366fa94bbeceb2c6d5d5f6b2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AutoIT_Compiled
Create hunting rule
Author:@bartblaze
Description:Identifies compiled AutoIT script (as EXE).

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RemcosRAT

Executable exe de91068b93c96919eee2ea1aea8cced755acec6a366fa94bbeceb2c6d5d5f6b2

(this sample)

anyrun
any.run
https://app.any.run/tasks/21fa56c0-8391-4aa1-b940-54a166390c75/
  
Dropping
remcos
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/114219/

Comments