MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e713e31d4edb7cd8f10ef3be6948015ea17f4969d0800c5c3149e8e53a0c2284. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 15


Intelligence 15 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e713e31d4edb7cd8f10ef3be6948015ea17f4969d0800c5c3149e8e53a0c2284
SHA3-384 hash: ba42fe000131261e3bafcba27a952790461e87e6496e8a1b22cd07549bdfba9e145859ea5b0e6c2143b8e4047f2b13ff
SHA1 hash: 990d3ffaac5194acd9e726de0fb3dc2821b48f36
MD5 hash: e2496ef7180b2cde1e12c038006e402b
humanhash: eight-social-zebra-uncle
File name:SecuriteInfo.com.Trojan.Heur.TP.PuW@beqLYM.17105.442
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:677'888 bytes
First seen:2025-04-11 20:49:54 UTC
Last seen:2025-04-11 22:26:44 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 0a345e5f05a3c067b5652877cbf02e11 (1 x RemcosRAT)
ssdeep 12288:j7M1Cv8rpbs3D7HON2qUprqDj6hQUpPDMmOsfuq:j7+LhS/F4mOnq
Threatray 1'005 similar samples on MalwareBazaar
TLSH T1E3E43D24B4B7C0E7C342873D1D2CA62A5529ED5A17B826CB33D46E660EE12D34B77C1B
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10522/11/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
Reporter SecuriteInfoCom
Tags:exe RemcosRAT

Intelligence

File Origin
# of uploads :
2
# of downloads :
484
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
remcos
Create hunting rule
ID:
1
File name:
SecuriteInfo.com.Trojan.Heur.TP.PuW@beqLYM.17105.442
Verdict:
Malicious activity
Analysis date:
2025-04-11 21:02:50 UTC
Tags:
rat remcos
Link:
https://app.any.run/tasks/c7f50986-895b-4fbe-bcf8-1cb89f623a88

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/1914/
Detection(s):
SecuriteInfo.com.Trojan.Heur.TP.PuW@beqLYM.17105.442.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
97.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67f9854fd6e7c3effad0506c
Tags:
virus
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
DNS request
Connection attempt
Sending a custom TCP request
Sending an HTTP GET request
Launching a process
Сreating synchronization primitives
Unauthorized injection to a system process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-debug fingerprint microsoft_visual_cc
Link:
https://www.filescan.io/uploads/67f9808840adfb5162c03b3e/reports/a6066584-c738-4c06-9489-4399c8cd9535/overview
Verdict:
Malicious
Labled as:
Trojan.TP.Generic
Link:
https://www.hybrid-analysis.com/sample/e713e31d4edb7cd8f10ef3be6948015ea17f4969d0800c5c3149e8e53a0c2284
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/19ff62c0-9344-4783-819d-68ab17e0ff28
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
rans.troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1663548
Signature
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Contains functionality to bypass UAC (CMSTPLUA)
Contains functionality to register a low level keyboard hook
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Contains functionalty to change the wallpaper
Found malware configuration
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Writes to foreign memory regions
Yara detected Remcos RAT
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
Score:
97%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/e713e31d4edb7cd8f10ef3be6948015ea17f4969d0800c5c3149e8e53a0c2284
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e713e31d4edb7cd8f10ef3be6948015ea17f4969d0800c5c3149e8e53a0c2284/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2025-04-11 20:50:18 UTC
File Type:
PE (Exe)
AV detection:
10 of 24 (41.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=44j6ghko3n6nr4io6o7gssabl2qx6slj2caayxbrjhuokoqmekca._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
admintool_iepassview
Create hunting rule
admintool_mailpassview
Create hunting rule
Similar samples:
124b893db4e3bc683c296095df39918daa94808e0b4043686d8f380a30c38cc8
RemcosRAT
1c9d34307f9492a0257d5e3f6eec997c6fd1d92dee13f9bff785a62645fa7cce
RemcosRAT
4cfc84d46074142fa3204777ac1a0cbd7ea155fcaf0739388df5d098abf8d7f4
RemcosRAT
8e7e6ed8638ee1a261b2ce3badcaae3d9a00573d2c3612883e10787c58eec5e3
RemcosRAT
cbca3eeb382b5547f69174b12adb1b7d34731fe4881d0d7000d2f2dcdde679ba
RemcosRAT
cc985a14a3106fa6cd7d46894e6e986a6e47c8f3a11f50c080cf85dc050d00c0
RemcosRAT
df4bce7a8c51de8213f720d59a5d07b54b954f65d468475a7af4cfabb5c85854
RemcosRAT
ed45a049347b7565ce1d6c2d28ccb92a58abd70177b37a777eb887470ffb6815
RemcosRAT
error
RemcosRAT
f15b81d00d3d99f387f0a55d7ef0d59326b35eeb9987c15574db35fa81f26e93
RemcosRAT
faed55ed0102b1b2e3d853e8633abecbb9cec6a5f41c630097d8eaeefafba060
RemcosRAT
+ 995 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
discovery
Link:
https://tria.ge/reports/250411-zmne4szta1/
Behaviour
Program crash
System Location Discovery: System Language Discovery
Verdict:
Suspicious
Tags:
remcos
YARA:
n/a
Link:
https://app.threat.zone/submission/62f4388a-4e07-4f94-9c37-8e3cbe58f4dc
Unpacked files
SH256 hash:
e713e31d4edb7cd8f10ef3be6948015ea17f4969d0800c5c3149e8e53a0c2284
MD5 hash:
e2496ef7180b2cde1e12c038006e402b
SHA1 hash:
990d3ffaac5194acd9e726de0fb3dc2821b48f36
Link:
https://www.unpac.me/results/563de42c-fea5-417a-b27e-d849116d03aa/
Malware family:
Remcos
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/e713e31d4edb/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e713e31d4edb7cd8f10ef3be6948015ea17f4969d0800c5c3149e8e53a0c2284

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:pe_detect_tls_callbacks
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RemcosRAT

Executable exe e713e31d4edb7cd8f10ef3be6948015ea17f4969d0800c5c3149e8e53a0c2284

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/1914/
  
URLhaus
https://urlhaus.abuse.ch/url/3508167/
  
Delivery method
Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
Reviews
IDCapabilitiesEvidence
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CloseHandle
KERNEL32.dll::CreateThreadpoolWork
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::LoadLibraryA
KERNEL32.dll::LoadLibraryExW
KERNEL32.dll::GetStartupInfoW
KERNEL32.dll::GetCommandLineA
KERNEL32.dll::GetCommandLineW
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::WriteConsoleW
KERNEL32.dll::ReadConsoleW
KERNEL32.dll::SetStdHandle
KERNEL32.dll::GetConsoleOutputCP
KERNEL32.dll::GetConsoleMode
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CreateFileW

Comments