MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e1ad3754ce46be3a6178d6050b3bde5b84cc9c0c8c4479fae1a529cdd3c8484b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 15


Intelligence 15 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e1ad3754ce46be3a6178d6050b3bde5b84cc9c0c8c4479fae1a529cdd3c8484b
SHA3-384 hash: 1d05cdb71765eb4398c97cc9dfe7ac8a0a8c80ab4db837353a9e6b06ba14109ceadc4e9852a4fa99f026c6320a43c212
SHA1 hash: fadc6aa8f947dfb40a3bae55c39ba433a5ce9d08
MD5 hash: b5ce7e5b550710b3ca40709b24c6bb97
humanhash: cat-magazine-moon-red
File name:DOCUMENTO_REPRESENTACION_GRAFICA_ELECTRONICA_FACTURA_DE_IMPUESTOS_PENDIENTES_DE_GENERADA_POR_LIQUIDACION_OFICINA_DE_HACIENDA_Y_CARTERApdf.exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:2'601'608 bytes
First seen:2023-05-06 10:31:49 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'606 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 24576:5qKGAOQASABHdnNDCz+5yUehrryg7dtW273HICh85SgLQkkQ+jAA8NRJKIfFDFF3:5qpA6oJrygDrP63QvAA8NRJFNpYg7
Threatray 1'881 similar samples on MalwareBazaar
TLSH T1F7C5BFF16BD57D56E6AE1E78B46A42846C74AC279608D25D7C8C3CD73FB83C08822B71
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):PE icon
dhash icon 22ddccae928a9c63 (2 x AsyncRAT, 1 x RemcosRAT)
Reporter 0xToxin
Tags:177-255-89-112 BlindEagle exe opendir remcos RemcosRAT


Avatar
0xToxin
downloaded from:
https://webmail.une.net.co/home/alex.londono@sistemasaries.com.co/Briefcase/

PW - 0523

Intelligence

File Origin
# of uploads :
1
# of downloads :
366
Origin country :
IL IL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Nuevo Documento Generado - Alcaldía Filadelfia Caldas.eml
Verdict:
Malicious activity
Analysis date:
2023-05-05 20:39:09 UTC
Tags:
keylogger
Link:
https://app.any.run/tasks/74795d24-aeca-44a5-b1b6-513f7b68dc2e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Remcos
Create hunting rule
Link:
https://www.capesandbox.com/analysis/387090/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.66890775.29635.4189.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Launching a process
Creating a process with a hidden window
Creating a file in the %AppData% subdirectories
Creating a file
DNS request
Sending a custom TCP request
Sending an HTTP GET request
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
overlay packed
Link:
https://www.filescan.io/uploads/64562ca60026d8d211a1c975/reports/7d1342ea-a8be-46cd-b977-fe890a3cb24a/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_70%
Link:
https://www.hybrid-analysis.com/sample/e1ad3754ce46be3a6178d6050b3bde5b84cc9c0c8c4479fae1a529cdd3c8484b
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
REMCOS
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f3bec6b8-88db-406a-b3e5-b758f5b1eee1
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1227472
Signature
.NET source code contains potential unpacker
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Contains functionality to bypass UAC (CMSTPLUA)
Contains functionality to modify clipboard data
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Delayed program exit found
Encrypted powershell cmdline option found
Found malware configuration
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Remcos
Uses dynamic DNS services
Writes to foreign memory regions
Yara detected Remcos RAT
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 860436 Sample: RTERApdf.exe Startdate: 06/05/2023 Architecture: WINDOWS Score: 100 51 Found malware configuration 2->51 53 Malicious sample detected (through community Yara rule) 2->53 55 Multi AV Scanner detection for submitted file 2->55 57 7 other signatures 2->57 7 RTERApdf.exe 1 5 2->7         started        11 Mgmfk.exe 2 2->11         started        13 Mgmfk.exe 1 2->13         started        process3 file4 41 C:\Users\user\AppData\Roaming\...\Mgmfk.exe, PE32 7->41 dropped 43 C:\Users\user\...\Mgmfk.exe:Zone.Identifier, ASCII 7->43 dropped 45 C:\Users\user\AppData\...\RTERApdf.exe.log, ASCII 7->45 dropped 59 Encrypted powershell cmdline option found 7->59 61 Writes to foreign memory regions 7->61 63 Allocates memory in foreign processes 7->63 15 InstallUtil.exe 7->15         started        18 InstallUtil.exe 3 17 7->18         started        21 powershell.exe 15 7->21         started        65 Multi AV Scanner detection for dropped file 11->65 67 Machine Learning detection for dropped file 11->67 69 Injects a PE file into a foreign processes 11->69 23 powershell.exe 11->23         started        25 InstallUtil.exe 11->25         started        27 powershell.exe 13 13->27         started        29 InstallUtil.exe 13->29         started        31 InstallUtil.exe 13->31         started        33 InstallUtil.exe 13->33         started        signatures5 process6 dnsIp7 71 Contains functionality to bypass UAC (CMSTPLUA) 15->71 73 Contains functionality to steal Chrome passwords or cookies 15->73 75 Contains functionality to modify clipboard data 15->75 79 2 other signatures 15->79 47 strekhost2066.duckdns.org 177.255.89.112, 49694, 5220 ColombiaMovilCO Colombia 18->47 49 geoplugin.net 178.237.33.50, 49695, 80 ATOM86-ASATOM86NL Netherlands 18->49 77 Installs a global keyboard hook 18->77 35 conhost.exe 21->35         started        37 conhost.exe 23->37         started        39 conhost.exe 27->39         started        signatures8 process9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e1ad3754ce46be3a6178d6050b3bde5b84cc9c0c8c4479fae1a529cdd3c8484b/
Threat name:
Win32.Trojan.Nekark
Create hunting rule
Status:
Malicious
First seen:
2023-05-05 23:27:17 UTC
File Type:
PE (.Net Exe)
Extracted files:
88
AV detection:
16 of 36 (44.44%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4gwtovgoi27duyly2ycqwo66locmzhamrrcht6xbuuu43u6ijbfq._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
2010a7e1a136a9881ba4db4beb99088ea77ea2997d36e6d1d16fc696b34fda8b
RemcosRAT
2b4c534df5fe4c7ee7a402f384109cb60b54c7f301ef8644e7b1eba397d89f2b
RemcosRAT
38455251726a64db957d8e30e6c1dc1ca2b10c35691dadbcf3bf8172babe94e3
RemcosRAT
3c2ffc42864aba9e07bb8cd494141ea7125a2d24a8717f0cf0a33da8020dbdfb
RemcosRAT
aa2caafd9a1d53df2112c9081fb5686e04283be0da13d94bacdfc8c9addf0c34
RemcosRAT
b19c0bb20a5fe51658666464950c582cef626cdf1f50bf5c775109a0cf2267db
RemcosRAT
c9ec59e23695adca831f06aca398c511cac81f2fd65c7353f14b4725791ab80a
RemcosRAT
cadf95355bd6ea18fdd3555ea3f85d102f40b3df0dc36b332f9ad8b505105f6e
RemcosRAT
f3e4dd541766cd7a3af91ef964b91ded632f13ebe69bd4fb5eadd563c0207059
RemcosRAT
+ 1'871 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:zzzzzempezandosinnadaparamandar4 persistence rat
Link:
https://tria.ge/reports/230506-mkyf3sba7z/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Checks computer location settings
Remcos
Malware Config
C2 Extraction:
strekhost2066.duckdns.org:5220
Unpacked files
SH256 hash:
788ef30d78644803155243cceb24474d4c1ca1b4e73562dfe2a83f89eb20597f
MD5 hash:
f11b4816940712ba820e6f81b35d415b
SHA1 hash:
fdb93e158d64fc63157d4a9eaf8ae0b7a8fa23e8
Link:
https://www.unpac.me/results/797caca0-a0fa-48b2-be44-e3d8686d5767/
SH256 hash:
ff8c24bce1eb009f0d5c47a09b96caf02726c285cea0d635082ad4da27e63d1b
MD5 hash:
9d6ec6072ee1814a4a01d1eb3fb67ba1
SHA1 hash:
d0b416de1c900b6bcb35dc182b2e8744f16c3289
Link:
https://www.unpac.me/results/797caca0-a0fa-48b2-be44-e3d8686d5767/
SH256 hash:
75ff202d9e3f9525651cc08bcbb1000206d43e0b9ea292f0dd2dd79067910e55
MD5 hash:
252d86215a9c6adac78b74989fa392d1
SHA1 hash:
9017fb0f9fa84ab3938e0ffdb4aa3a69f9e1afb2
Detections:
win_remcos_auto
Create hunting rule
Link:
https://www.unpac.me/results/797caca0-a0fa-48b2-be44-e3d8686d5767/
SH256 hash:
336b1f4780bf1992b7e6d0c1109e3ebaa04b021f51553319eceaebbb941437f5
MD5 hash:
2365f41e2ef1a0c1ec1a9cf6940aafd9
SHA1 hash:
859cc337f634d9deb0d7bf9efb63ec9cbaecb77d
Detections:
Remcos
Create hunting rule
win_remcos_auto
Create hunting rule
Link:
https://www.unpac.me/results/797caca0-a0fa-48b2-be44-e3d8686d5767/
SH256 hash:
c33da8a625f7427aa5cf711ffbb44528f513083234c9cc9d488d860b23b293a1
MD5 hash:
4e0228ddc9df326db5da415fe5262c1d
SHA1 hash:
0eee9661955d79c2094cb4e6dd9b173599ce5d1e
Link:
https://www.unpac.me/results/797caca0-a0fa-48b2-be44-e3d8686d5767/
SH256 hash:
e1ad3754ce46be3a6178d6050b3bde5b84cc9c0c8c4479fae1a529cdd3c8484b
MD5 hash:
b5ce7e5b550710b3ca40709b24c6bb97
SHA1 hash:
fadc6aa8f947dfb40a3bae55c39ba433a5ce9d08
Link:
https://www.unpac.me/results/797caca0-a0fa-48b2-be44-e3d8686d5767/
Malware family:
Remcos
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/e1ad3754ce46/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/e1ad3754ce46be3a6178d6050b3bde5b84cc9c0c8c4479fae1a529cdd3c8484b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:pe_imphash
Create hunting rule
Rule name:PE_Potentially_Signed_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:QbotStuff
Create hunting rule
Author:anonymous
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/387090/

Comments