MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e44d45e08e69bdd44317e5cac98e49b242323e87f5a706ca870dd25079af1d17. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 13


Intelligence 13 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e44d45e08e69bdd44317e5cac98e49b242323e87f5a706ca870dd25079af1d17
SHA3-384 hash: cd080f0d8c0c015297c4a5b6192b105626ccf9a437807de18d41846dac78e247fb19441185d10bfa2c3adbc65dea3022
SHA1 hash: 13fa8f30a4728285d230aa625ec4281431a4b023
MD5 hash: df7bcc6a339e5d1d61f040c538669b2b
humanhash: mango-sink-grey-steak
File name:df7bcc6a339e5d1d61f040c538669b2b.exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:2'934'288 bytes
First seen:2022-05-25 08:17:54 UTC
Last seen:2022-05-25 08:52:03 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 01d1b984e99e67b6f7ae46199d7dfd92 (12 x RemcosRAT)
ssdeep 49152:YoiS5cQs+nAZ+6mtY1ECgzxGB6qUUPvZeCzmteDR3uRCc8gLAF4KA2bab+6GvoFg:YoiErrtlYaCg7qlvQC5R3uRtEFlQb+6Y
Threatray 11'696 similar samples on MalwareBazaar
TLSH T1FFD533522C87E5ECC2A6873C0D24C4B1C349AC5D8963F540A5CF6EFB766D90E7A78827
TrID 32.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
28.9% (.EXE) Win32 Executable (generic) (4505/5/1)
13.0% (.EXE) OS/2 Executable (generic) (2029/13)
12.8% (.EXE) Generic Win/DOS Executable (2002/3)
12.8% (.EXE) DOS Executable Generic (2000/1)
File icon (PE):PE icon
dhash icon c4d48eaa8ad4d4f8 (1'000 x RemcosRAT, 1 x Worm.Ramnit, 1 x Vjw0rm)
Reporter abuse_ch
Tags:exe RAT RemcosRAT

Intelligence

File Origin
# of uploads :
2
# of downloads :
298
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
remcos
Create hunting rule
ID:
1
File name:
df7bcc6a339e5d1d61f040c538669b2b.exe
Verdict:
Malicious activity
Analysis date:
2022-05-25 10:01:41 UTC
Tags:
rat remcos stealer
Link:
https://app.any.run/tasks/1136686f-9b2b-4f98-bd8f-a3605b0b5268

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Remcos
Create hunting rule
Link:
https://www.capesandbox.com/analysis/274419/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for analyzing tools
Searching for the window
Сreating synchronization primitives
Launching cmd.exe command interpreter
Creating a file in the %AppData% subdirectories
Creating a file in the %temp% directory
Launching a process
Changing a file
Creating a file
Creating a process from a recently created file
Creating a process with a hidden window
Creating a window
Running batch commands
Sending a custom TCP request
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Blocking the User Account Control
Forced shutdown of a system process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed shell32.dll
Link:
https://www.filescan.io/uploads/628de65365e338159938dc47/reports/a71aaebe-3828-421a-a1ae-aa3a25fd1ccb/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/43796671-f273-4c8c-991a-e5df7d2ee04c
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1001433
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Contains functionality to inject code into remote processes
Disables UAC (registry)
Hides threads from debuggers
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Query firmware table information (likely to detect VMs)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file / registry access)
Tries to steal Mail credentials (via file registry)
Uses cmd line tools excessively to alter registry or file data
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 633951 Sample: W6nrQnsTCP.exe Startdate: 25/05/2022 Architecture: WINDOWS Score: 100 54 Antivirus detection for dropped file 2->54 56 Antivirus / Scanner detection for submitted sample 2->56 58 Multi AV Scanner detection for submitted file 2->58 60 3 other signatures 2->60 7 itunes.exe 3 1 2->7         started        11 W6nrQnsTCP.exe 4 5 2->11         started        14 itunes.exe 2->14         started        process3 dnsIp4 44 185.29.9.125, 2404, 49743, 49744 DATACLUB-SE European Union 7->44 62 Antivirus detection for dropped file 7->62 64 Multi AV Scanner detection for dropped file 7->64 66 Tries to steal Mail credentials (via file registry) 7->66 74 4 other signatures 7->74 16 itunes.exe 1 7->16         started        19 cmd.exe 1 7->19         started        21 svchost.exe 7->21         started        27 2 other processes 7->27 38 C:\Users\user\AppData\Roaming\...\itunes.exe, PE32 11->38 dropped 40 C:\Users\user\...\itunes.exe:Zone.Identifier, ASCII 11->40 dropped 42 C:\Users\user\AppData\Local\...\install.vbs, data 11->42 dropped 68 Query firmware table information (likely to detect VMs) 11->68 70 Hides threads from debuggers 11->70 72 Tries to detect sandboxes / dynamic malware analysis system (registry check) 11->72 23 cmd.exe 1 11->23         started        25 wscript.exe 11->25         started        file5 signatures6 process7 signatures8 46 Tries to steal Instant Messenger accounts or passwords 16->46 48 Tries to steal Mail credentials (via file / registry access) 16->48 29 conhost.exe 19->29         started        31 reg.exe 1 19->31         started        50 Uses cmd line tools excessively to alter registry or file data 23->50 33 reg.exe 1 23->33         started        36 conhost.exe 23->36         started        process9 signatures10 52 Disables UAC (registry) 33->52
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e44d45e08e69bdd44317e5cac98e49b242323e87f5a706ca870dd25079af1d17/
Threat name:
Win32.PUA.SuspiciousProcStarter
Create hunting rule
Status:
Malicious
First seen:
2022-05-25 05:08:16 UTC
File Type:
PE (Exe)
Extracted files:
8
AV detection:
30 of 41 (73.17%)
Threat level:
  1/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=4rgulyeong65iqyx4xfmtdsjwjbdepuh6wtqnsuhbxjfa6npdulq._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
35077e72a589bccd4ddab3a75c7ff5d90421d4e79c1cc582c610f31e63f3f24b
RemcosRAT
4ccc8a0286b73b62f34fee2f3927c12a73aa47f272f40a4ba7085d84dc1785aa
RemcosRAT
56400d285883e72264ab693e17d3f94bb35df61618891768c8959932b5d9f140
RemcosRAT
576183a33f5247a852bc65a4dc4cbca5762bfbad1291a82572681f7075dc6123
RemcosRAT
625f25dedd3f7e114dc89cff907dfec350df5cbb4efa09942f2b5ed9950c1216
RemcosRAT
a2fad2958e6dd09d0d980d4e5d158c2a2eb18963d47fc95779c22bc2d203cb8e
RemcosRAT
eb1d3b24830e9b7370fbe2c0128d43f6ba9272b8990f73446e9137b299a369bd
RemcosRAT
f75fd5ce522743fe012bdf743efc66e481d72d92b6eb0465621a77a4600ff6b5
RemcosRAT
+ 11'686 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:rh1 evasion persistence rat themida trojan
Link:
https://tria.ge/reports/220525-j6958adben/
Behaviour
Modifies registry class
Modifies registry key
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Adds Run key to start application
Checks whether UAC is enabled
Checks BIOS information in registry
Checks computer location settings
Deletes itself
Loads dropped DLL
Themida packer
Executes dropped EXE
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Remcos
UAC bypass
Malware Config
C2 Extraction:
185.29.9.125:2404
Unpacked files
SH256 hash:
d1caee32211cb6baa2733bdf4c9180402207208dca2d62a4aeffee647718f816
MD5 hash:
3dc086e6c2489d07b8864255910ba5b2
SHA1 hash:
b6ef469fa780898dc496ac2debcc746a00c0e8c5
Link:
https://www.unpac.me/results/ab2c77a5-744b-4217-8221-9f04049c2a81/
SH256 hash:
e44d45e08e69bdd44317e5cac98e49b242323e87f5a706ca870dd25079af1d17
MD5 hash:
df7bcc6a339e5d1d61f040c538669b2b
SHA1 hash:
13fa8f30a4728285d230aa625ec4281431a4b023
Link:
https://www.unpac.me/results/ab2c77a5-744b-4217-8221-9f04049c2a81/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.50
Link:
https://yomi.yoroi.company/submissions/e44d45e08e69bdd44317e5cac98e49b242323e87f5a706ca870dd25079af1d17

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_Themida
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with Themida
Rule name:INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer
Create hunting rule
Author:ditekSHen
Description:detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Rule name:remcos_rat
Create hunting rule
Author:jeFF0Falltrades

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RemcosRAT

Executable exe e44d45e08e69bdd44317e5cac98e49b242323e87f5a706ca870dd25079af1d17

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2209629/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/274419/

Comments