MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 deae18121ea6827386098ac1d40d14952f55c7555558d516ff769b4e89655ded. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 18


Intelligence 18 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: deae18121ea6827386098ac1d40d14952f55c7555558d516ff769b4e89655ded
SHA3-384 hash: 291dce41458fd3eec6861879f772dd0e42ffadd1b4d3cb7a9494ecbb876e91e114d925fa6c96b1ca999cf8c8fd54c4a7
SHA1 hash: 7d003910e435153f65c2726f8d3fe2669606fcbf
MD5 hash: 08ac08e7223680fbe534d31ae219e649
humanhash: diet-nineteen-chicken-ack
File name:08ac08e7223680fbe534d31ae219e649.exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'132'544 bytes
First seen:2025-01-08 07:45:26 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'468 x Formbook, 12'206 x SnakeKeylogger)
ssdeep 24576:BPd+pxd29086WHK9M9yBj2ESIMkM6ZI6d:BPspx4bFHhENMkM6G
Threatray 201 similar samples on MalwareBazaar
TLSH T17A35D0C0373AB701CE7CBA704926EDB813652E786000F9E66DDE27D7759DB126A08F16
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter abuse_ch
Tags:exe RemcosRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
443
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
remcos
Create hunting rule
ID:
1
File name:
08ac08e7223680fbe534d31ae219e649.exe
Verdict:
Malicious activity
Analysis date:
2025-01-08 07:50:04 UTC
Tags:
rat remcos
Link:
https://app.any.run/tasks/cb47fab2-5766-4fb4-901f-f592b4b7a618

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
Win.Packed.Malwarex-10041013-0
Create hunting rule

Verdict:
Malicious
Score:
97.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=677e2dfaffdcee13ec86f3fb
Tags:
remcos virus micro msil
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Searching for synchronization primitives
Creating a window
Creating a process with a hidden window
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a file in the %temp% directory
Launching a process
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Connection attempt
Adding an exclusion to Microsoft Defender
Enabling autorun by creating a file
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed packed packer_detected
Link:
https://www.filescan.io/uploads/677e2d3be34d7e7dabf401da/reports/91660af6-3bbf-4626-a9a0-d4721d7a67a3/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/deae18121ea6827386098ac1d40d14952f55c7555558d516ff769b4e89655ded
Malware family:
REMCOS
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/fb1f2613-cd41-4104-b9ee-66ce9374c982
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
rans.troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1585770
Signature
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
AI detected suspicious sample
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Contains functionality to bypass UAC (CMSTPLUA)
Contains functionality to register a low level keyboard hook
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Contains functionalty to change the wallpaper
Delayed program exit found
Detected Remcos RAT
Found malware configuration
Injects a PE file into a foreign processes
Loading BitLocker PowerShell Module
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Remcos
Sigma detected: Scheduled temp file as task from temp location
Suricata IDS alerts for network traffic
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM3
Yara detected Remcos RAT
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1585770 Sample: bfVHfzigaU.exe Startdate: 08/01/2025 Architecture: WINDOWS Score: 100 46 time.windows.com 2->46 50 Suricata IDS alerts for network traffic 2->50 52 Found malware configuration 2->52 54 Malicious sample detected (through community Yara rule) 2->54 56 12 other signatures 2->56 8 NaYpuoGDsghFyf.exe 5 2->8         started        11 bfVHfzigaU.exe 7 2->11         started        signatures3 process4 file5 58 Antivirus detection for dropped file 8->58 60 Multi AV Scanner detection for dropped file 8->60 62 Contains functionality to bypass UAC (CMSTPLUA) 8->62 70 6 other signatures 8->70 14 NaYpuoGDsghFyf.exe 8->14         started        17 schtasks.exe 1 8->17         started        38 C:\Users\user\AppData\...38aYpuoGDsghFyf.exe, PE32 11->38 dropped 40 C:\...40aYpuoGDsghFyf.exe:Zone.Identifier, ASCII 11->40 dropped 42 C:\Users\user\AppData\Local\...\tmp9BB9.tmp, XML 11->42 dropped 44 C:\Users\user\AppData\...\bfVHfzigaU.exe.log, ASCII 11->44 dropped 64 Uses schtasks.exe or at.exe to add and modify task schedules 11->64 66 Adds a directory exclusion to Windows Defender 11->66 68 Injects a PE file into a foreign processes 11->68 19 bfVHfzigaU.exe 3 11->19         started        22 powershell.exe 23 11->22         started        24 powershell.exe 23 11->24         started        26 schtasks.exe 1 11->26         started        signatures6 process7 dnsIp8 28 conhost.exe 17->28         started        48 185.241.208.87, 2404, 49702, 49799 GBTCLOUDUS Moldova Republic of 19->48 72 Detected Remcos RAT 19->72 74 Loading BitLocker PowerShell Module 22->74 30 WmiPrvSE.exe 22->30         started        32 conhost.exe 22->32         started        34 conhost.exe 24->34         started        36 conhost.exe 26->36         started        signatures9 process10
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/deae18121ea6827386098ac1d40d14952f55c7555558d516ff769b4e89655ded
Detection:
remcos
Create hunting rule
Link:
https://mwdb.cert.pl/sample/deae18121ea6827386098ac1d40d14952f55c7555558d516ff769b4e89655ded/
Threat name:
ByteCode-MSIL.Trojan.RedLineStealer
Create hunting rule
Status:
Malicious
First seen:
2024-12-29 20:51:56 UTC
File Type:
PE (.Net Exe)
Extracted files:
41
AV detection:
23 of 24 (95.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=32xbqeq6u2bhhbqjrla5idiusuxvlr2vkvmnkfx7o2nu5clflxwq._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
unknown_loader_037
Create hunting rule
Similar samples:
51c0bcbc40451c10e3b56df10853156378e8dbfb32ee63ea936737d42818822c
RemcosRAT
b25e19cd5dc45047c4ad68fbe940dd1f923800201666adf9164ec5fe5d74f6e4
RemcosRAT
be5fbed126be0685414464f8d18c42027cbb09c884640c35e2420f96c0d254df
RemcosRAT
c8017f526793dd8b6b6e98bfa9847fcf3aa7c4096a8432719a8324e06ba8c088
RemcosRAT
e744e0aa890a2d9b5e6eed8403cb16f6098baee4a0529b1fabc0644ee4ba6b32
RemcosRAT
error
RemcosRAT
+ 191 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:remotehost discovery execution rat
Link:
https://tria.ge/reports/250108-jlyxfszrcw/
Behaviour
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Checks computer location settings
Command and Scripting Interpreter: PowerShell
Remcos
Remcos family
Malware Config
C2 Extraction:
185.241.208.87:2404
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/4ea1a40e-63fd-4572-ba35-72b08de1894c
Unpacked files
SH256 hash:
366cfb2015078d80637bad5e41ba879903fafc17fe6d24d74210fbbfeaa07bd6
MD5 hash:
6c6509adcd386e5aa612f7a9c3d8a04b
SHA1 hash:
d36a9e2f20a88d035da9f976ba551358cbb3f913
Link:
https://www.unpac.me/results/bf2cdc4e-33f9-4957-a7b7-f309c0cedc72/
SH256 hash:
11b5dc7c7c6c06b2036fd0648557abab533122095972f7a3c848dfbc3ab9320c
MD5 hash:
db57c1f2e8400eb604081110c8e36367
SHA1 hash:
a8e7f07c0de4b18b8cef629609a9b6ebe7bf45c7
Detections:
Remcos
Create hunting rule
win_remcos_auto
Create hunting rule
win_remcos_w0
Create hunting rule
malware_windows_remcos_rat
Create hunting rule
win_remcos_rat_unpacked
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
Create hunting rule
Link:
https://www.unpac.me/results/bf2cdc4e-33f9-4957-a7b7-f309c0cedc72/
Parent samples :
deae18121ea6827386098ac1d40d14952f55c7555558d516ff769b4e89655ded
905eb3c354f4f1210442b25983482a2612d6354df9c3d26beb9a0bdaf1e9ac04
SH256 hash:
50f7026b4699c7b9e0045d0a308c5ffbe34f2e2dad3572b350f81e4ada77f120
MD5 hash:
a2be634d535cd9ee26564ddf6c6aec21
SHA1 hash:
7915c2074bb94544abdf7e5d122d17e02d390d9a
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/bf2cdc4e-33f9-4957-a7b7-f309c0cedc72/
SH256 hash:
deae18121ea6827386098ac1d40d14952f55c7555558d516ff769b4e89655ded
MD5 hash:
08ac08e7223680fbe534d31ae219e649
SHA1 hash:
7d003910e435153f65c2726f8d3fe2669606fcbf
Link:
https://www.unpac.me/results/bf2cdc4e-33f9-4957-a7b7-f309c0cedc72/
Malware family:
Remcos
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/deae18121ea6/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AgentTesla_DIFF_Common_Strings_01
Create hunting rule
Author:schmidtsz
Description:Identify partial Agent Tesla strings
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments