MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e8b670a416ea518bd6073c440615b624fc91b70cf55e8b63bd524924c37b2970. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 12


Intelligence 12 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e8b670a416ea518bd6073c440615b624fc91b70cf55e8b63bd524924c37b2970
SHA3-384 hash: b7c77fe45db3c009152fe835a606733cf69d8563a23df05e29c836c8c604ac4ba77a31dcf3d6edf904da50e655563c4c
SHA1 hash: 3f89b631974b2f2e306f56603230126a3c580055
MD5 hash: 71f387101239dfa10204a0b2d7541910
humanhash: paris-cola-muppet-india
File name:Confirmación de pedido nuevo-5309,pdf.exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:719'872 bytes
First seen:2021-08-10 05:48:31 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 64b99ed56fe51c14a44881c90ac9ff50 (4 x RemcosRAT, 1 x BitRAT)
ssdeep 12288:SnE1eDMrSuUFA+/ARNb43cRuM7bUwYgsI4pR8/CH3eVgNm+7p:42HfUG+oRNb43chyXI4pR0U3eC
Threatray 447 similar samples on MalwareBazaar
TLSH T135E46D56A2B09F32C33B1638CD8B43D9A55BBE243D1C6BC6BEEA0D1C7F291913624457
dhash icon 12b232f2b98c8681 (12 x Formbook, 12 x RemcosRAT, 2 x AveMariaRAT)
Reporter lowmal3
Tags:exe RemcosRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
114
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Confirmación de pedido nuevo-5309,pdf.exe
Verdict:
Malicious activity
Analysis date:
2021-08-10 05:50:21 UTC
Tags:
installer
Link:
https://app.any.run/tasks/05bf289f-a23d-4e59-8e07-6a9a8ee136b8

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.W32.AIDetect.malware2.17036.3219.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
DNS request
Connection attempt
Sending a custom TCP request
Creating a file
Deleting a recently created file
Launching a process
Connection attempt to an infection source
Creating a process from a recently created file
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a recently created process
Query of malicious DNS domain
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
REMCOS
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/cc1db11e-8d63-45b0-a7c0-3189ecdfa7f0
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/829909
Signature
C2 URLs / IPs found in malware configuration
Contains functionality to capture and log keystrokes
Contains functionality to inject code into remote processes
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Creates a thread in another existing process (thread injection)
Delayed program exit found
Detected Remcos RAT
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Uses dynamic DNS services
Writes to foreign memory regions
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 462340 Sample: Confirmaci#U00f3n de pedido... Startdate: 10/08/2021 Architecture: WINDOWS Score: 100 28 newlogs.ddns.net 2->28 54 Multi AV Scanner detection for domain / URL 2->54 56 Found malware configuration 2->56 58 Malicious sample detected (through community Yara rule) 2->58 60 6 other signatures 2->60 7 Confirmaci#U00f3n de pedido nuevo-5309,pdf.exe 1 19 2->7         started        12 Sxtwbxg.exe 16 2->12         started        14 Sxtwbxg.exe 16 2->14         started        signatures3 process4 dnsIp5 30 onedrive.live.com 7->30 38 2 other IPs or domains 7->38 24 C:\Users\Public\Libraries\...\Sxtwbxg.exe, PE32 7->24 dropped 62 Writes to foreign memory regions 7->62 64 Creates a thread in another existing process (thread injection) 7->64 66 Injects a PE file into a foreign processes 7->66 16 dialer.exe 2 7->16         started        32 192.168.2.1 unknown unknown 12->32 34 onedrive.live.com 12->34 40 2 other IPs or domains 12->40 68 Multi AV Scanner detection for dropped file 12->68 70 Machine Learning detection for dropped file 12->70 20 mshta.exe 12->20         started        36 onedrive.live.com 14->36 42 2 other IPs or domains 14->42 22 mshta.exe 14->22         started        file6 signatures7 process8 dnsIp9 26 newlogs.ddns.net 185.140.53.12, 1111, 49723, 49724 DAVID_CRAIGGG Sweden 16->26 44 Contains functionality to steal Chrome passwords or cookies 16->44 46 Contains functionality to capture and log keystrokes 16->46 48 Contains functionality to inject code into remote processes 16->48 50 Contains functionality to steal Firefox passwords or cookies 20->50 52 Delayed program exit found 20->52 signatures10
Detection:
remcos
Create hunting rule
Link:
https://mwdb.cert.pl/sample/e8b670a416ea518bd6073c440615b624fc91b70cf55e8b63bd524924c37b2970/
Threat name:
Win32.Backdoor.Remcos
Create hunting rule
Status:
Malicious
First seen:
2021-08-09 20:11:42 UTC
AV detection:
13 of 28 (46.43%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5c3hbjaw5jiyxvqhhrcamfnwet6jdnym6vpiwy55kjesjq33ffya._file
Verdict:
malicious
Similar samples:
1b945f30cc3cff4673d9a29a7f865edf107b7bfb64e5da763672449ef94fb7b9
RemcosRAT
1bf82794b7a65dd38c5f0f78813b1f882a9ff838fa94543e74a3a29a22307032
RemcosRAT
39f47c4612520d9844a152198245ee842bdf40de4c65e35c03771252f7d7b381
RemcosRAT
4a84faebc419ed0cddbc9e37b337a3090a01051d3ed7d1650c2845369b9a1d63
RemcosRAT
4c0c348d5fe6d35084087f5df83a5d5f15aa75a30b1dc37204f701383a7685eb
RemcosRAT
62960caf3d007638be89631e502733f30c42a9ba0269e8c00457c9dec10e9136
RemcosRAT
c70917b8034aedf54cf578fa9db38399a6129376bc7d06cacd6b324fed45c5a7
RemcosRAT
e982ae5ea3e7d8b92372076442bd0f96a572d974a2265c609a0cc5e4b4eac9cb
RemcosRAT
+ 437 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:happiness persistence rat
Link:
https://tria.ge/reports/210810-q28vt6dpg6/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Adds Run key to start application
Remcos
Malware Config
C2 Extraction:
newlogs.ddns.net:1111
Unpacked files
SH256 hash:
795b2b5d6668147d7924ac96f90741ddc2a2b5003f455fb842b613a286fbf8fc
MD5 hash:
53011b69a7231aea23d66805a681144b
SHA1 hash:
e3d0d157e763c865e79ccc5bedc2fd5fd90413f7
Link:
https://www.unpac.me/results/041feba8-6fd8-4a99-92c8-eee578d284b0/
SH256 hash:
b8e5e9369d0c4aeab61ce40ae5f3918fc63e8e936caf5e226237abc7e026d98d
MD5 hash:
bf3c62fbb78a7bf6ec325a99a526d3bb
SHA1 hash:
ca21c59cd4862100d89f2fcc0783a601caeed4be
Link:
https://www.unpac.me/results/041feba8-6fd8-4a99-92c8-eee578d284b0/
SH256 hash:
e8b670a416ea518bd6073c440615b624fc91b70cf55e8b63bd524924c37b2970
MD5 hash:
71f387101239dfa10204a0b2d7541910
SHA1 hash:
3f89b631974b2f2e306f56603230126a3c580055
Link:
https://www.unpac.me/results/041feba8-6fd8-4a99-92c8-eee578d284b0/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e8b670a416ea518bd6073c440615b624fc91b70cf55e8b63bd524924c37b2970

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_RemcosRAT
Create hunting rule
Author:abuse.ch
Rule name:INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer
Create hunting rule
Author:ditekSHen
Description:detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Rule name:Parallax
Create hunting rule
Author:@bartblaze
Description:Identifies Parallax RAT.
Rule name:Remcos
Create hunting rule
Author:kevoreilly
Description:Remcos Payload
Rule name:remcos_rat
Create hunting rule
Author:jeFF0Falltrades
Rule name:REMCOS_RAT_variants
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

Executable exe e8b670a416ea518bd6073c440615b624fc91b70cf55e8b63bd524924c37b2970

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments