MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f07ddc7c081b1106a27590e5497bec74f0d48f18b8c49d17ea57fa3d7d0704d8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 14


Intelligence 14 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f07ddc7c081b1106a27590e5497bec74f0d48f18b8c49d17ea57fa3d7d0704d8
SHA3-384 hash: 90568ffad25a2522e7c6b3dc96c257dd42bd0dc9ef9bcf5846e310c285767e3bdf484a1cdf1b8d225a5ca01411ff1653
SHA1 hash: 6f1cdddfcdfb8f4793eed122b0f8d3dff1da7d04
MD5 hash: 947a5c046f8cfb1b6fb007bf67f55499
humanhash: cold-arizona-finch-tennis
File name:947a5c046f8cfb1b6fb007bf67f55499.exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:986'112 bytes
First seen:2023-05-15 06:10:35 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'648 x AgentTesla, 19'452 x Formbook, 12'201 x SnakeKeylogger)
ssdeep 24576:Dorx6sHZUlQskhoiEul5qr34YoJHI3DYmM:4+QUIl5qcHI3
Threatray 3'049 similar samples on MalwareBazaar
TLSH T10925F110B1EE0867C7AD83F6454919440B7861AB7D27DAFC0D9E70D9E9D2F021B92EB3
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):PE icon
dhash icon 0c6c4c5ac4c9c0a4 (6 x Loki, 6 x AgentTesla, 5 x Formbook)
Reporter abuse_ch
Tags:exe RAT RemcosRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
264
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
remcos
Create hunting rule
ID:
1
File name:
947a5c046f8cfb1b6fb007bf67f55499.exe
Verdict:
Malicious activity
Analysis date:
2023-05-15 06:16:07 UTC
Tags:
keylogger remcos
Link:
https://app.any.run/tasks/1169859b-0569-4e73-aa2f-b93f77057a35

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Remcos
Create hunting rule
Link:
https://www.capesandbox.com/analysis/389950/
Detection(s):
SecuriteInfo.com.Win32.PWSX-gen.15495.28634.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Creating a file
Сreating synchronization primitives
Setting a keyboard event handler
DNS request
Connecting to a non-recommended domain
Sending a custom TCP request
Sending an HTTP GET request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/6461ccfb2c920903b492738c/reports/3cd5530b-efb6-45e5-96aa-2efabbef4c05/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/f07ddc7c081b1106a27590e5497bec74f0d48f18b8c49d17ea57fa3d7d0704d8
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
REMCOS
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d50e6204-b29f-4b14-84cf-d642b200d4f4
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1233412
Signature
.NET source code contains potential unpacker
C2 URLs / IPs found in malware configuration
Contains functionality to bypass UAC (CMSTPLUA)
Contains functionality to modify clipboard data
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Delayed program exit found
Found malware configuration
Injects a PE file into a foreign processes
Installs a global keyboard hook
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sigma detected: Remcos
Yara detected Remcos RAT
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f07ddc7c081b1106a27590e5497bec74f0d48f18b8c49d17ea57fa3d7d0704d8/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2023-05-15 06:11:09 UTC
File Type:
PE (.Net Exe)
Extracted files:
15
AV detection:
18 of 24 (75.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6b65y7aidmiqnitvsdsus67motynjdyyxdcj2f7kk75d27ihatma._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
14fb2daf697ee302647b7d63c26e94f443c9516a5a707b85952b1158e5ffe12a
RemcosRAT
1abe11cf0a879b99c092a403e9efedf7ecda8e92c6708c31c799ce36c2da26a8
RemcosRAT
2010a7e1a136a9881ba4db4beb99088ea77ea2997d36e6d1d16fc696b34fda8b
RemcosRAT
2b4c534df5fe4c7ee7a402f384109cb60b54c7f301ef8644e7b1eba397d89f2b
RemcosRAT
32fcd31207c5e310957801fca81578c9dcba9ed3515809f62a7d50d93ad033db
RemcosRAT
3c2ffc42864aba9e07bb8cd494141ea7125a2d24a8717f0cf0a33da8020dbdfb
RemcosRAT
6053c5c3a4202b8c2e6b2f176a99c980233f63024be06b67d3a30e2f0b4470f4
RemcosRAT
aa2caafd9a1d53df2112c9081fb5686e04283be0da13d94bacdfc8c9addf0c34
RemcosRAT
edd0bc79de9c5ecb3d4903d20259b356171aa41af2df2a43aad0bf36bda95c7b
RemcosRAT
+ 3'039 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:remotehost rat
Link:
https://tria.ge/reports/230515-gxl1xshc9s/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Remcos
Malware Config
C2 Extraction:
seanblacin.sytes.net:6110
Unpacked files
SH256 hash:
660a0e60dbd1342b35432a53599a7a1bd6f62d2d350b4de1b48600e7d8d67ad4
MD5 hash:
c4a97d373e8c64e65f316cd487311e6f
SHA1 hash:
b9a60aa1fb129eb2e8cf6022dcc7725349252dd8
Detections:
Remcos
Create hunting rule
win_remcos_auto
Create hunting rule
Link:
https://www.unpac.me/results/63a2a734-f276-48cd-8d45-8fd04b0b3396/
Parent samples :
291755c89bb6d77dd43c74cb0413df8037244debd6bedd2a869edf7dfd090d64
14fb2daf697ee302647b7d63c26e94f443c9516a5a707b85952b1158e5ffe12a
f07ddc7c081b1106a27590e5497bec74f0d48f18b8c49d17ea57fa3d7d0704d8
97e54013704e2edc63c7d31ee30dfba3d2bcdbdd91df650ff0a01e560c3e111a
e2c60159ad9908ac2a1ab446c1866dfe5a59b1535ca29f111ae56833996d82b8
a6bf09d8242fd2933426629a504f995a5d624d555bd2f28a49876762ec0a03a6
43c39e05ae59835e16df8bd732cd035292db70bc2c2d6d95ac354622bfa376ec
SH256 hash:
082aa0c32152ac700b1c2709b89cda6d1d758de4497e560ace58526c8ced886e
MD5 hash:
3e1a0cd659081a8789dee9e6fa0ba046
SHA1 hash:
a56b0edf09277b0d112be01a30c6459d671673db
Link:
https://www.unpac.me/results/63a2a734-f276-48cd-8d45-8fd04b0b3396/
SH256 hash:
65693593a2335b9101dd57b143423346d9bc362bd890fb4707e17e54a242f9df
MD5 hash:
b950313aa97e6ec2c3d0a9e0a3dc49df
SHA1 hash:
a549c17b796c631aab2b15d409911023332c0980
Link:
https://www.unpac.me/results/63a2a734-f276-48cd-8d45-8fd04b0b3396/
SH256 hash:
16c255190eaaf1b60ec7d07abcac5f614ea197cee2416ca9d01bb563c526c87d
MD5 hash:
fb4ed205b442f470bbf10913128efdcb
SHA1 hash:
9a0a4c5ae429769e3253a9a3daefa24270b87a5b
Link:
https://www.unpac.me/results/63a2a734-f276-48cd-8d45-8fd04b0b3396/
Parent samples :
ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397
de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e
SH256 hash:
6722a58c81f6d11004e880bd8481acc423bf96afd46bf692f1562cfa4c5852bd
MD5 hash:
d92d2ba953be4be2d6f2bc859ec5c607
SHA1 hash:
05da51752277bd907ebcfb799524ec7655abbc3a
Link:
https://www.unpac.me/results/63a2a734-f276-48cd-8d45-8fd04b0b3396/
SH256 hash:
f07ddc7c081b1106a27590e5497bec74f0d48f18b8c49d17ea57fa3d7d0704d8
MD5 hash:
947a5c046f8cfb1b6fb007bf67f55499
SHA1 hash:
6f1cdddfcdfb8f4793eed122b0f8d3dff1da7d04
Link:
https://www.unpac.me/results/63a2a734-f276-48cd-8d45-8fd04b0b3396/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/f07ddc7c081b/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:iexplorer_remcos
Create hunting rule
Author:iam-py-test
Description:Detect iexplorer being taken over by Remcos
Rule name:INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
Create hunting rule
Author:ditekSHen
Description:Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Rule name:pe_imphash
Create hunting rule
Rule name:Remcos
Create hunting rule
Author:kevoreilly
Description:Remcos Payload
Rule name:REMCOS_RAT_variants
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Windows_Trojan_Remcos_b296e965
Create hunting rule
Author:Elastic Security
Rule name:win_remcos_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.remcos.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RemcosRAT

Executable exe f07ddc7c081b1106a27590e5497bec74f0d48f18b8c49d17ea57fa3d7d0704d8

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2295669/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/389950/

Comments