MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e53122230df3df822e7e4476d12fe580f5b6a18e793b42703e00fb58e9f2547b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 10


Intelligence 10 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e53122230df3df822e7e4476d12fe580f5b6a18e793b42703e00fb58e9f2547b
SHA3-384 hash: 5d489d13e9123ea668b5285312b14f917bf266d58d8503b09b02249972c9788c610612bf639d143ef31a8f8a642bda02
SHA1 hash: fadad789a4e993ca141098d03bfdaf3ff01518b5
MD5 hash: 4c9a295d70129a40efd7d3d5427fed2d
humanhash: lamp-wolfram-burger-oven
File name:4c9a295d_by_Libranalysis
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:709'407 bytes
First seen:2021-05-19 13:12:02 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 099c0646ea7282d232219f8807883be0 (476 x Formbook, 210 x Loki, 107 x AgentTesla)
ssdeep 12288:6MWUt/YjsYN+Au8rM10rx9NwjTUxhz4L39RZ36FrSLaS5w+/:6rUt/1AFyQ9qY/z+rarSuSi+
Threatray 216 similar samples on MalwareBazaar
TLSH B6E4F1856973D2B6EC376C3D2B2250EBEE77DE23D314A622F867772B04F56128512C21
Reporter Libranalysis
Tags:RemcosRAT


Avatar
Libranalysis
Uploaded as part of the sample sharing project

Intelligence

File Origin
# of uploads :
1
# of downloads :
89
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
4c9a295d_by_Libranalysis
Verdict:
Malicious activity
Analysis date:
2021-05-19 13:25:00 UTC
Tags:
installer rat remcos keylogger
Link:
https://app.any.run/tasks/a35fb6ce-17d8-4e2b-a592-97272c7e3778

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Remcos
Create hunting rule
Link:
https://www.capesandbox.com/analysis/158607/
Detection(s):
PUA.Win.Trojan.Casino-141
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a file
Sending a UDP request
Creating a file in the %AppData% subdirectories
Unauthorized injection to a recently created process
Setting a keyboard event handler
DNS request
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Connection attempt to an infection source
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
rans.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/785042
Signature
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Contains functionalty to change the wallpaper
Delayed program exit found
Detected Remcos RAT
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Installs a global keyboard hook
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 417444 Sample: 4c9a295d_by_Libranalysis Startdate: 19/05/2021 Architecture: WINDOWS Score: 100 29 u876137.nsupdate.info 2->29 31 u876136.nsupdate.info 2->31 33 3 other IPs or domains 2->33 43 Found malware configuration 2->43 45 Malicious sample detected (through community Yara rule) 2->45 47 Multi AV Scanner detection for submitted file 2->47 49 3 other signatures 2->49 7 4c9a295d_by_Libranalysis.exe 1 23 2->7         started        11 emtwf.exe 18 2->11         started        13 emtwf.exe 9 2->13         started        signatures3 process4 file5 21 C:\Users\user\AppData\Roaming\...\emtwf.exe, PE32 7->21 dropped 23 C:\Users\user\AppData\Local\...\System.dll, PE32 7->23 dropped 51 Detected unpacking (changes PE section rights) 7->51 53 Detected unpacking (overwrites its own PE header) 7->53 55 Contains functionalty to change the wallpaper 7->55 63 3 other signatures 7->63 15 4c9a295d_by_Libranalysis.exe 2 3 7->15         started        25 C:\Users\user\AppData\Local\...\System.dll, PE32 11->25 dropped 27 C:\Users\user\AppData\...\amqihupbgvwzlva, DOS 11->27 dropped 57 Multi AV Scanner detection for dropped file 11->57 59 Contains functionality to steal Chrome passwords or cookies 11->59 61 Maps a DLL or memory area into another process 11->61 19 emtwf.exe 11->19         started        signatures6 process7 dnsIp8 35 u876134.nsupdate.info 194.5.98.145, 2404, 49698, 49699 DANILENKODE Netherlands 15->35 37 u876137.nsupdate.info 15->37 39 4 other IPs or domains 15->39 41 Installs a global keyboard hook 15->41 signatures9
Detection:
remcos
Create hunting rule
Link:
https://mwdb.cert.pl/sample/e53122230df3df822e7e4476d12fe580f5b6a18e793b42703e00fb58e9f2547b/
Threat name:
Win32.Trojan.Remcos
Create hunting rule
Status:
Malicious
First seen:
2021-05-19 13:14:28 UTC
File Type:
PE (Exe)
Extracted files:
5
AV detection:
24 of 47 (51.06%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=4uyseiyn6ppyelt6ir3ncl7fqd23nimope5ue4b6ad5vr2pskr5q._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
30552657a06df54de322d5d689ca77d2cacbf8e85136ca915843c9a99e4f26c0
RemcosRAT
34ae6e94fd8ce101fadff4baf68d7c0b8bf606d1796b7c8199e7d45a9bc57a02
RemcosRAT
40dc655d06780c3f628f6ec2c3848d797c8ba88dcc50e3397e4e464ec12aaade
RemcosRAT
8017cf230cb7f4e72b6128a7e696821749c4990dbd446f8206d948c3ed6530ec
RemcosRAT
8c3a6d5b05325958afeb7885e7d4bbe59f7f5a849b5acdf0a8f7cbb8febc4a81
RemcosRAT
a0bb5a244b144a8e10087fd70a04580c3bb8c4c8add7da671a06f10020473004
RemcosRAT
af0249150bee4fec74c124f89019cd260c9aacd7b7a7715192b5097f1948eb82
RemcosRAT
c85d33153d768a2f98066c8ba07e58890cbac4c185e4ef45739fb03750e1088b
RemcosRAT
f0896ba259cc40a67474db857cbca2cd43099f5b49be45c3e3a3a34a06765b7f
RemcosRAT
f4dcc52b899bbe0d34ffbb44032c0186953c174beaf647c0556c7e71385c6bb4
RemcosRAT
+ 206 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos persistence rat
Link:
https://tria.ge/reports/210519-astygzvlka/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Loads dropped DLL
Remcos
Malware Config
C2 Extraction:
u876134.nsupdate.info:2404
u876134.nvpn.to:2404
u876135.nsupdate.info:2404
u876136.nsupdate.info:2404
u876137.nsupdate.info:2404
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_RemcosRAT
Create hunting rule
Author:abuse.ch
Rule name:Chrome_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Chrome in files like avemaria
Rule name:INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer
Create hunting rule
Author:ditekSHen
Description:detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Rule name:Keylog_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Contains Keylog
Rule name:remcos_rat
Create hunting rule
Author:jeFF0Falltrades
Rule name:REMCOS_RAT_variants
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/158607/

Comments