MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 eb7cabca916e8bf7e7cfc0bae4d7569987a6516796dd7f6f9e6fe93c519dad62. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 12


Maldoc score: 10


Intelligence 12 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: eb7cabca916e8bf7e7cfc0bae4d7569987a6516796dd7f6f9e6fe93c519dad62
SHA3-384 hash: 6377fb90717d4124a0f2da4aae6f2989e143a149dd44d3ffa7d8f2eec0dfb2c5532aa548aa1d96662b48caa57e1d3d9b
SHA1 hash: 79d42f688c7ff089585c07994bd6396d948602cb
MD5 hash: b9fa8f1bf3cfb74acc2c5f58b67058b8
humanhash: lake-pennsylvania-four-coffee
File name:RFQ-MVP300-3400.doc
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:74'752 bytes
First seen:2022-10-12 07:47:09 UTC
Last seen:Never
File type:Word file doc
MIME type:application/msword
ssdeep 1536:TsCXf9SEqrr+j7WzWdCBfudtZnZJcn3bsWkC3b1L49wGk86JzC52p0cwvd3jo0Vu:oCXlnirj
TLSH T125735242A243C23BC37511B3449BEFF0B6B92F9A9919056F3604337A6DBA7648716B30
TrID 52.6% (.DOC) Microsoft Word document (30000/1/2)
33.3% (.DOC) Microsoft Word document (old ver.) (19000/1/2)
14.0% (.) Generic OLE2 / Multistream Compound (8000/1)
Reporter abuse_ch
Tags:doc RemcosRAT

Office OLE Information

This malware samples appears to be an Office document. The following table provides more information about this document using oletools and oledump.

OLE id
Maldoc score: 10
OLE dump

MalwareBazaar was able to identify 12 sections in this file using oledump:

Section IDSection sizeSection name
1114 bytesCompObj
24096 bytesDocumentSummaryInformation
34096 bytesSummaryInformation
47901 bytes1Table
512153 bytesData
6406 bytesMacros/PROJECT
771 bytesMacros/PROJECTwm
831858 bytesMacros/VBA/NewMacros
9924 bytesMacros/VBA/ThisDocument
102912 bytesMacros/VBA/_VBA_PROJECT
11580 bytesMacros/VBA/dir
124096 bytesWordDocument
OLE vba

MalwareBazaar was able to extract and deobfuscate VBA script(s) the following information from OLE objects embedded in this file using olevba:

TypeKeywordDescription
AutoExecAutoOpenRuns when the Word document is opened
AutoExecAuto_OpenRuns when the Excel Workbook is opened
SuspiciousShellMay run an executable file or a system command
SuspiciousvbHideMay run an executable file or a system command
SuspiciousChrMay attempt to obfuscate specific strings (use option --deobf to deobfuscate)
SuspiciousBase64 StringsBase64-encoded strings were detected, may be used to obfuscate strings (option --decode to see all)

Intelligence

File Origin
# of uploads :
1
# of downloads :
253
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
TwinWave.EvilDoc.DOCXSTRGOOD.//
Create hunting rule

TwinWave.EvilDoc.StringBuidlersEveryRoseHasItsThorn.20210308.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.TakeMeHomeTonight.20210923.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Office.Macro-13.UNOFFICIAL
Create hunting rule

Sanesecurity.Badmacro.doc_shellao.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.DOCXSTRGOOD.SPTTH.210526.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.OutRunThis.20220121.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Сreating synchronization primitives
Creating a process with a hidden window
Creating a file in the %temp% directory
Launching a process
Changing an executable file
Creating a process from a recently created file
Running batch commands
DNS request
Sending a custom TCP request
Running batch commands by exploiting the app vulnerability
Infecting executable files
Result
Verdict:
Malicious
File Type:
Legacy Word File with Macro
Link:
https://app.docguard.net/eb7cabca916e8bf7e7cfc0bae4d7569987a6516796dd7f6f9e6fe93c519dad62/results/dashboard
Behaviour
BlacklistAPI detected
Document image
Image:
Download PNG
Document image
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
certutil certutil.exe cmd cmd.exe macros macros-on-open packed timeout wscript
Link:
https://www.filescan.io/uploads/63467134aab5b3e31a6ab1ab/reports/570e306e-cfd6-4241-beb3-6dfe885dd542/overview
Label:
Malicious
Suspicious Score:
8.2/10
Score Malicious:
82%
Score Benign:
18%
Link:
https://www.malware.ai/gui/files/?id=12a97e24-726d-43e1-ae2b-cd0fe2535d6e
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/eb7cabca916e8bf7e7cfc0bae4d7569987a6516796dd7f6f9e6fe93c519dad62
Details
Macro with Startup Hook
Detected macro logic that will automatically execute on document open. Most malware contains some execution hook.
Document With Few Pages
Document contains between one and three pages of content. Most malicious documents are sparse in page count.
Macro Contains Suspicious String
Detected a macro with a suspicious string. Suspicious strings include privileged function calls, obfuscations, odd registry keys, etc...
Macro with Hidden Shell
The VBA Shell() command is leveraged by this macro with a window style of '0' or 'vbHide'.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
expl.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/1088624
Signature
.NET source code contains very large strings
Command shell drops VBS files
Document contains an embedded VBA macro which may execute processes
Document contains an embedded VBA with base64 encoded strings
Document contains an embedded VBA with many string operations indicating source code obfuscation
Document exploit detected (process start blacklist hit)
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
System process connects to network (likely due to code injection or exploit)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 721216 Sample: RFQ-MVP300-3400.doc Startdate: 12/10/2022 Architecture: WINDOWS Score: 96 45 Multi AV Scanner detection for submitted file 2->45 47 Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros) 2->47 49 Machine Learning detection for sample 2->49 51 6 other signatures 2->51 9 WINWORD.EXE 292 23 2->9         started        process3 file4 33 C:\Users\user\...\~DFEE70F84A39A74DD5.TMP, Composite 9->33 dropped 12 cmd.exe 2 9->12         started        process5 file6 41 C:\Users\user\AppData\Local\Temp\script.vbs, ASCII 12->41 dropped 57 Command shell drops VBS files 12->57 16 wscript.exe 1 12->16         started        18 timeout.exe 12->18         started        20 timeout.exe 12->20         started        signatures7 process8 process9 22 cmd.exe 16->22         started        24 cmd.exe 16->24         started        process10 26 certutil.exe 14 22->26         started        31 bin.exe 1 5 24->31         started        dnsIp11 43 teleldyne.com 199.188.200.156, 443, 49171, 49172 NAMECHEAP-NETUS United States 26->43 35 C:\Users\user\AppData\Local\Temp\bin.exe, PE32 26->35 dropped 37 C:\Users\user\AppData\Local\...\jimjam[1].exe, PE32 26->37 dropped 39 C:\Users\...\824AAE07EE08294A295815D6FDE94439, PE32 26->39 dropped 53 System process connects to network (likely due to code injection or exploit) 26->53 55 Machine Learning detection for dropped file 31->55 file12 signatures13
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/eb7cabca916e8bf7e7cfc0bae4d7569987a6516796dd7f6f9e6fe93c519dad62/
Threat name:
Win32.Trojan.Valyria
Create hunting rule
Status:
Malicious
First seen:
2022-10-12 00:31:54 UTC
File Type:
Document
Extracted files:
19
AV detection:
20 of 41 (48.78%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5n6kxsurn2f7pz6pyc5ojv2wtgd2mulhs3ox6346n7utyum5vvra._file
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:remotehost macro macro_on_action persistence rat
Link:
https://tria.ge/reports/221012-jm4t4ache6/
Behaviour
Checks processor information in registry
Creates scheduled task(s)
Delays execution with timeout.exe
Enumerates system info in registry
Modifies Internet Explorer settings
Modifies registry class
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Office loads VBA resources, possible macro or embedded object present
Enumerates physical storage devices
Drops file in Windows directory
Suspicious use of SetThreadContext
Adds Run key to start application
Checks computer location settings
Loads dropped DLL
Executes dropped EXE
Downloads MZ/PE file
Process spawned unexpected child process
Remcos
Malware Config
C2 Extraction:
37.0.14.206:6081
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/3eeea14f-9d47-4151-97d5-6e6ef6c41974
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/eb7cabca916e/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/eb7cabca916e8bf7e7cfc0bae4d7569987a6516796dd7f6f9e6fe93c519dad62

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:informational_win_ole_protected
Create hunting rule
Author:Jeff White (karttoon@gmail.com) @noottrak
Description:Identify OLE Project protection within documents.
Rule name:Office_AutoOpen_Macro
Create hunting rule
Author:Florian Roth
Description:Detects an Microsoft Office file that contains the AutoOpen Macro function

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments