MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e7aa9ed4edc37d0b7515085211d1107ff1a54f2ca2651bd6698ae345663b93c6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 11


Intelligence 11 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e7aa9ed4edc37d0b7515085211d1107ff1a54f2ca2651bd6698ae345663b93c6
SHA3-384 hash: 217a885791e3579d6b1f8b5e49320b717c9c7fafad8aba643d3d30ab2dd6c958227147528bcab5ee61ca8cceda5ecd94
SHA1 hash: f7ba2ca8ab4e2f35c364cb54594a75f92a9b5d72
MD5 hash: 50b29fbd0c1b26b9f3dd1be13f464fb4
humanhash: hotel-muppet-eleven-fourteen
File name:Urgent RFQ_AP65425652_03242,pdf.exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:711'168 bytes
First seen:2021-07-23 09:36:51 UTC
Last seen:2021-07-23 11:10:53 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 58af898a8945f807ca70ebf9933b9268 (4 x RemcosRAT, 1 x BitRAT)
ssdeep 12288:RcOqhpe5sWWUgjIkdcCMTOArWe/C36lAnm4vNOpRKa:R7q+sWiItCoCdv
Threatray 663 similar samples on MalwareBazaar
TLSH T1D1E45D22A052E8F2C1166AB94C1A2B586995FD7039713C4726E4F87CFEBF6C13C1E947
dhash icon 72c28292b2a888e0 (7 x RemcosRAT, 1 x BitRAT, 1 x AveMariaRAT)
Reporter abuse_ch
Tags:exe RemcosRAT

Intelligence

File Origin
# of uploads :
2
# of downloads :
138
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Urgent RFQ_AP65425652_03242,pdf.exe
Verdict:
Malicious activity
Analysis date:
2021-07-23 09:56:45 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/161e1355-2cf4-4930-b35e-a085b20cc9c8

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Remcos
Create hunting rule
Link:
https://www.capesandbox.com/analysis/173577/
Detection(s):
SecuriteInfo.com.W32.AIDetect.malware2.19331.4272.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Dbatloader
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/c2c75694-d8ed-47cb-a27d-a965bec75d5b
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/820662
Signature
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Creates a thread in another existing process (thread injection)
Delayed program exit found
Detected Remcos RAT
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Writes to foreign memory regions
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 453073 Sample: Urgent RFQ_AP65425652_03242... Startdate: 23/07/2021 Architecture: WINDOWS Score: 100 51 Found malware configuration 2->51 53 Malicious sample detected (through community Yara rule) 2->53 55 Multi AV Scanner detection for submitted file 2->55 57 4 other signatures 2->57 6 Urgent RFQ_AP65425652_03242,pdf.exe 1 19 2->6         started        11 Krtsmra.exe 16 2->11         started        13 Krtsmra.exe 18 2->13         started        process3 dnsIp4 25 r50dhq.dm.files.1drv.com 6->25 27 onedrive.live.com 6->27 29 dm-files.fe.1drv.com 6->29 23 C:\Users\Public\Libraries\...\Krtsmra.exe, PE32 6->23 dropped 59 Writes to foreign memory regions 6->59 61 Creates a thread in another existing process (thread injection) 6->61 63 Injects a PE file into a foreign processes 6->63 15 secinit.exe 2 6->15         started        31 r50dhq.dm.files.1drv.com 11->31 35 2 other IPs or domains 11->35 65 Multi AV Scanner detection for dropped file 11->65 67 Machine Learning detection for dropped file 11->67 19 mshta.exe 11->19         started        33 r50dhq.dm.files.1drv.com 13->33 37 2 other IPs or domains 13->37 21 ieinstal.exe 13->21         started        file5 signatures6 process7 dnsIp8 39 zubby2468.hopto.org 185.140.53.12, 8905 DAVID_CRAIGGG Sweden 15->39 41 192.168.2.1 unknown unknown 15->41 43 Contains functionality to steal Chrome passwords or cookies 15->43 45 Contains functionality to inject code into remote processes 15->45 47 Contains functionality to steal Firefox passwords or cookies 15->47 49 Delayed program exit found 15->49 signatures9
Detection:
remcos
Create hunting rule
Link:
https://mwdb.cert.pl/sample/e7aa9ed4edc37d0b7515085211d1107ff1a54f2ca2651bd6698ae345663b93c6/
Threat name:
Win32.Trojan.Woreflint
Create hunting rule
Status:
Malicious
First seen:
2021-07-23 08:37:14 UTC
AV detection:
10 of 46 (21.74%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=46vj5vhnyn6qw5ivbbjbduiqp7y2ktzmujsrxvtjrlrukzr3spda._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
0a049a6f200348e229ebaa13728cd0d19de4839c741d4faec3dd64207860153d
RemcosRAT
2e928af33de11fedaf5d0c388e96ac67509b64bd445a3f4a576f46ec2a0d5374
RemcosRAT
46d5443a4f41fb67709a7f323f12a2835d22167bb06447c72b9c5115fbd8a028
RemcosRAT
4a7f380de68e6969bcedffe6c7d5b01ac9ecd1f4df9f2bb79fb7fec94252e095
RemcosRAT
4fa4ab75bd8f5439907cadec8c16b8e006045e73bc45adbbd5ab368b20cf2c5f
RemcosRAT
7863e8d94d7f595345e13ed45b8600c86d3a8bea389ca25950dfae8a9d94195a
RemcosRAT
8acdca153a4e16a5ff668a0a5ad8c274d2307a88cda385575ee4fbb8374d2254
RemcosRAT
9a11c83839b1379e794a24659adf6dd9515f5581c24e97aca7fe1f3fa19ce0d6
RemcosRAT
c3ce62a44812edeca97182d5f26639b222ebe684021e7a7b922a499bd32d7f95
RemcosRAT
f74e5e77ee6f64654fb912f76a8b5095d783bf3af22dea186ef7b5730c4a868e
RemcosRAT
+ 653 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:modiloader family:remcos botnet:hero persistence rat trojan
Link:
https://tria.ge/reports/210723-61mpqb7xve/
Behaviour
Suspicious use of WriteProcessMemory
Adds Run key to start application
ModiLoader, DBatLoader
Remcos
Malware Config
C2 Extraction:
zubby2468.hopto.org:8905
Unpacked files
SH256 hash:
d174ea83359cec0b0a35da88fa2a1791a1308e35a5e36e83f51a2723e48582a6
MD5 hash:
5c63077607b089e7045eb5e93d8324d9
SHA1 hash:
9ca12c4d6e4a97269d26fe6755aae441276bff42
Link:
https://www.unpac.me/results/ecf79623-5572-4bb9-9b5e-74326f516d81/
SH256 hash:
e7aa9ed4edc37d0b7515085211d1107ff1a54f2ca2651bd6698ae345663b93c6
MD5 hash:
50b29fbd0c1b26b9f3dd1be13f464fb4
SHA1 hash:
f7ba2ca8ab4e2f35c364cb54594a75f92a9b5d72
Link:
https://www.unpac.me/results/ecf79623-5572-4bb9-9b5e-74326f516d81/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e7aa9ed4edc37d0b7515085211d1107ff1a54f2ca2651bd6698ae345663b93c6

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

Executable exe e7aa9ed4edc37d0b7515085211d1107ff1a54f2ca2651bd6698ae345663b93c6

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/173577/

Comments