MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e62061d984fda6be6d10edf1131454a5c81ead30c4440a75bd3ba80b1b83b099. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 13


Intelligence 13 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e62061d984fda6be6d10edf1131454a5c81ead30c4440a75bd3ba80b1b83b099
SHA3-384 hash: 894e2fc712c2b2d0572f803fadcef1553b203d1cb9c8eab7307b718bbb13209b2cd7101c1facdf2357033ce8a0c38f82
SHA1 hash: eb541a3baddf3305edd84241aba904071721d313
MD5 hash: ae1d170677ac0a614ed5d88b943c7635
humanhash: carbon-nebraska-purple-mountain
File name:PO-54752454235.hta
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:17'925 bytes
First seen:2024-11-06 08:01:36 UTC
Last seen:Never
File type:HTML Application (hta) hta
MIME type:text/html
ssdeep 192:F5sOwRdhB9NyK9KFTtJOyJ4YyuQSzTyW1gWHgNWvWk+gyVMOQE8JHumvNgczc:8O2hlatJOyJ4YyGgCGgyVEtzvNgczc
TLSH T1E982E0081E01AF5E66054CDCE93E907D51E106BA2F37B38DA9B6FEE01E360DF25A1587
Magika vba
Reporter abuse_ch
Tags:hta RemcosRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
88
Origin country :
DE DE
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.VBS.Agent.UQJ.tr.26577.18382.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=672b256a8d23d904913421d5
Tags:
powershell gumen
Result
Verdict:
Malicious
File Type:
HTA File - Malicious
Link:
https://app.docguard.net/e62061d984fda6be6d10edf1131454a5c81ead30c4440a75bd3ba80b1b83b099/results/dashboard
Behaviour
BlacklistAPI detected
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
dropper packed powershell
Link:
https://www.filescan.io/uploads/672b2282702fa4abc8c3e61c/reports/703d2dc7-d3a8-45cf-a830-c728ca40abe4/overview
Verdict:
Malicious
Labled as:
TrojanDownloader/VBS.Maloader
Link:
https://www.hybrid-analysis.com/sample/e62061d984fda6be6d10edf1131454a5c81ead30c4440a75bd3ba80b1b83b099
Result
Verdict:
UNKNOWN
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
rans.troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1549929
Signature
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
C2 URLs / IPs found in malware configuration
Contains functionality to bypass UAC (CMSTPLUA)
Contains functionality to register a low level keyboard hook
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Contains functionalty to change the wallpaper
Creates autostart registry keys with suspicious names
Delayed program exit found
Detected Remcos RAT
Found malware configuration
Injects a PE file into a foreign processes
Loading BitLocker PowerShell Module
Machine Learning detection for dropped file
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Powershell drops PE file
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Remcos
Sigma detected: Scheduled temp file as task from temp location
Sigma detected: Suspect Svchost Activity
Sigma detected: Suspicious MSHTA Child Process
Suricata IDS alerts for network traffic
Suspicious powershell command line found
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected Remcos RAT
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1549929 Sample: PO-54752454235.hta Startdate: 06/11/2024 Architecture: WINDOWS Score: 100 131 Suricata IDS alerts for network traffic 2->131 133 Found malware configuration 2->133 135 Malicious sample detected (through community Yara rule) 2->135 137 11 other signatures 2->137 13 mshta.exe 1 2->13         started        16 uXVGwksuXiVBy.exe 2->16         started        18 remcos.exe 2->18         started        20 svchost.exe 1 2 2->20         started        process3 dnsIp4 167 Suspicious powershell command line found 13->167 23 powershell.exe 15 17 13->23         started        169 Multi AV Scanner detection for dropped file 16->169 171 Machine Learning detection for dropped file 16->171 173 Injects a PE file into a foreign processes 16->173 28 uXVGwksuXiVBy.exe 16->28         started        30 schtasks.exe 16->30         started        32 remcos.exe 18->32         started        34 schtasks.exe 18->34         started        36 remcos.exe 18->36         started        109 127.0.0.1 unknown unknown 20->109 signatures5 process6 dnsIp7 111 185.196.11.151, 49707, 80 SIMPLECARRIERCH Switzerland 23->111 105 C:\Users\user\AppData\...\xKtzvdEoDAjLmvN.exe, PE32 23->105 dropped 155 Powershell drops PE file 23->155 38 xKtzvdEoDAjLmvN.exe 6 23->38         started        42 conhost.exe 23->42         started        157 Detected Remcos RAT 28->157 44 conhost.exe 30->44         started        46 conhost.exe 34->46         started        file8 signatures9 process10 file11 101 C:\Users\user\AppData\...\uXVGwksuXiVBy.exe, PE32 38->101 dropped 103 C:\Users\user\AppData\Local\...\tmpEC29.tmp, XML 38->103 dropped 147 Multi AV Scanner detection for dropped file 38->147 149 Contains functionality to bypass UAC (CMSTPLUA) 38->149 151 Contains functionalty to change the wallpaper 38->151 153 8 other signatures 38->153 48 xKtzvdEoDAjLmvN.exe 38->48         started        52 powershell.exe 23 38->52         started        54 powershell.exe 23 38->54         started        56 schtasks.exe 38->56         started        signatures12 process13 file14 99 C:\ProgramData\Remcos\remcos.exe, PE32 48->99 dropped 125 Detected Remcos RAT 48->125 127 Creates autostart registry keys with suspicious names 48->127 58 remcos.exe 48->58         started        129 Loading BitLocker PowerShell Module 52->129 61 conhost.exe 52->61         started        63 conhost.exe 54->63         started        65 conhost.exe 56->65         started        signatures15 process16 signatures17 159 Multi AV Scanner detection for dropped file 58->159 161 Machine Learning detection for dropped file 58->161 163 Adds a directory exclusion to Windows Defender 58->163 165 Injects a PE file into a foreign processes 58->165 67 remcos.exe 58->67         started        71 powershell.exe 58->71         started        73 powershell.exe 58->73         started        75 schtasks.exe 58->75         started        process18 dnsIp19 107 66.63.162.79, 2404, 49713, 49715 ASN-QUADRANET-GLOBALUS United States 67->107 139 Detected Remcos RAT 67->139 141 Writes to foreign memory regions 67->141 143 Maps a DLL or memory area into another process 67->143 77 svchost.exe 67->77         started        79 svchost.exe 67->79         started        145 Loading BitLocker PowerShell Module 71->145 81 conhost.exe 71->81         started        83 WmiPrvSE.exe 71->83         started        85 conhost.exe 73->85         started        87 conhost.exe 75->87         started        signatures20 process21 process22 89 chrome.exe 77->89         started        92 chrome.exe 79->92         started        dnsIp23 113 192.168.2.9, 138, 2404, 443 unknown unknown 89->113 115 192.168.2.4 unknown unknown 89->115 117 239.255.255.250 unknown Reserved 89->117 94 chrome.exe 89->94         started        97 chrome.exe 92->97         started        process24 dnsIp25 119 s-part-0014.t-0009.t-msedge.net 13.107.246.42, 443, 49737 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 94->119 121 s-part-0017.t-0009.t-msedge.net 13.107.246.45, 443, 49706, 49738 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 94->121 123 8 other IPs or domains 94->123
Score:
96%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/e62061d984fda6be6d10edf1131454a5c81ead30c4440a75bd3ba80b1b83b099
Detection:
remcos
Create hunting rule
Link:
https://mwdb.cert.pl/sample/e62061d984fda6be6d10edf1131454a5c81ead30c4440a75bd3ba80b1b83b099/
Threat name:
Script-WScript.Downloader.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2024-11-05 09:54:01 UTC
File Type:
Text (VBS)
AV detection:
8 of 38 (21.05%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4yqgdwme7wtl43iq5xyrgfcuuxeb5ljqyrcau5n5houawg4dwcmq._file
Verdict:
malicious
Label(s):
unknown_loader_037
Create hunting rule
Similar samples:
error
RemcosRAT
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:remotehost discovery execution persistence rat
Link:
https://tria.ge/reports/241106-jw468avrfy/
Behaviour
Enumerates system info in registry
Modifies Internet Explorer settings
Modifies registry class
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Browser Information Discovery
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Adds Run key to start application
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Blocklisted process makes network request
Command and Scripting Interpreter: PowerShell
Downloads MZ/PE file
Remcos
Remcos family
Malware Config
C2 Extraction:
66.63.162.79:2404
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e62061d984fda6be6d10edf1131454a5c81ead30c4440a75bd3ba80b1b83b099

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RemcosRAT

HTML Application (hta) hta e62061d984fda6be6d10edf1131454a5c81ead30c4440a75bd3ba80b1b83b099

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3278329/
  
Delivery method
Distributed via web download

Comments