MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f0b85c3d890019c1d88274fb49f4caa52d696917a418ffee89324ad40d0076c9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 18


Intelligence 18 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f0b85c3d890019c1d88274fb49f4caa52d696917a418ffee89324ad40d0076c9
SHA3-384 hash: c2b3b7724ca0bf6fc7a20951c1d5063780b6c19286e50ca4fbbb2c5f84ba46ff4f5196091275484b26978de68c83ed54
SHA1 hash: 14bb12af44b33a9177bd38f22f970f7e3db80bc9
MD5 hash: c54fea66c5150e6d924ca83f504c1aa4
humanhash: leopard-april-nebraska-nebraska
File name:f0b85c3d890019c1d88274fb49f4caa52d696917a418ffee89324ad40d0076c9
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'008'128 bytes
First seen:2023-06-08 11:30:32 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'461 x Formbook, 12'202 x SnakeKeylogger)
ssdeep 12288:s7z5GoJiGaq5aurWxRe3H3/U7FuMM/e3ColjhNETt9iUME6nlXl0iNawmPV2/1DL:65GoR5auvU7kKXsAE6nj02oc/SMtwY7
Threatray 4'352 similar samples on MalwareBazaar
TLSH T11A25230435169E1BE5A777711A21AFB04732BC9A3420E7CF78C167CF5BA1B650235B8B
TrID 63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.2% (.SCR) Windows screen saver (13097/50/3)
9.0% (.EXE) Win64 Executable (generic) (10523/12/4)
5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon c4ccccd4d4cccccc (8 x AgentTesla, 7 x Loki, 3 x RemcosRAT)
Reporter adrian__luca
Tags:exe RemcosRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
258
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
remcos
Create hunting rule
ID:
1
File name:
f0b85c3d890019c1d88274fb49f4caa52d696917a418ffee89324ad40d0076c9
Verdict:
Malicious activity
Analysis date:
2023-06-08 11:29:48 UTC
Tags:
rat remcos
Link:
https://app.any.run/tasks/fcae2391-dc2a-4ccd-9e73-572a59b64911

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Remcos
Create hunting rule
Link:
https://www.capesandbox.com/analysis/396923/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.67237337.8365.7483.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Creating a process with a hidden window
Launching a process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/6481bbf78237763a9bd68595/reports/fdf063b6-7fab-4296-a2b0-7158d381eaba/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/f0b85c3d890019c1d88274fb49f4caa52d696917a418ffee89324ad40d0076c9
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
REMCOS
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/269bceee-f3c4-4841-a97a-e3dd076517a1
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1251423
Signature
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Remcos
Sigma detected: Scheduled temp file as task from temp location
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Remcos RAT
Yara detected UAC Bypass using CMSTP
Yara detected WebBrowserPassView password recovery tool
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 884448 Sample: FwoJij4prD.exe Startdate: 08/06/2023 Architecture: WINDOWS Score: 100 106 Multi AV Scanner detection for domain / URL 2->106 108 Found malware configuration 2->108 110 Malicious sample detected (through community Yara rule) 2->110 112 10 other signatures 2->112 10 FwoJij4prD.exe 7 2->10         started        14 CFnqYf.exe 5 2->14         started        16 remcos.exe 2->16         started        18 2 other processes 2->18 process3 file4 86 C:\Users\user\AppData\Roaming\CFnqYf.exe, PE32 10->86 dropped 88 C:\Users\user\...\CFnqYf.exe:Zone.Identifier, ASCII 10->88 dropped 90 C:\Users\user\AppData\Local\...\tmp51AC.tmp, XML 10->90 dropped 92 C:\Users\user\AppData\...\FwoJij4prD.exe.log, ASCII 10->92 dropped 126 Uses schtasks.exe or at.exe to add and modify task schedules 10->126 128 Adds a directory exclusion to Windows Defender 10->128 130 Injects a PE file into a foreign processes 10->130 20 FwoJij4prD.exe 2 4 10->20         started        23 powershell.exe 21 10->23         started        25 powershell.exe 21 10->25         started        35 2 other processes 10->35 132 Multi AV Scanner detection for dropped file 14->132 134 Machine Learning detection for dropped file 14->134 27 schtasks.exe 14->27         started        29 CFnqYf.exe 14->29         started        31 schtasks.exe 16->31         started        33 remcos.exe 16->33         started        37 2 other processes 16->37 signatures5 process6 file7 82 C:\ProgramData\Remcos\remcos.exe, PE32 20->82 dropped 84 C:\ProgramData\...\remcos.exe:Zone.Identifier, ASCII 20->84 dropped 39 remcos.exe 20->39         started        42 conhost.exe 23->42         started        44 WerFault.exe 23->44         started        46 conhost.exe 25->46         started        48 conhost.exe 27->48         started        50 conhost.exe 31->50         started        52 conhost.exe 35->52         started        process8 signatures9 114 Multi AV Scanner detection for dropped file 39->114 116 Machine Learning detection for dropped file 39->116 118 Adds a directory exclusion to Windows Defender 39->118 120 Injects a PE file into a foreign processes 39->120 54 remcos.exe 39->54         started        58 powershell.exe 39->58         started        60 powershell.exe 39->60         started        62 schtasks.exe 39->62         started        process10 dnsIp11 94 212.193.30.230, 3330, 49699, 49700 SPD-NETTR Russian Federation 54->94 96 geoplugin.net 178.237.33.50, 49701, 80 ATOM86-ASATOM86NL Netherlands 54->96 122 Maps a DLL or memory area into another process 54->122 124 Installs a global keyboard hook 54->124 64 remcos.exe 54->64         started        67 remcos.exe 54->67         started        69 remcos.exe 54->69         started        77 13 other processes 54->77 71 conhost.exe 58->71         started        73 conhost.exe 60->73         started        75 conhost.exe 62->75         started        signatures12 process13 dnsIp14 100 Tries to steal Instant Messenger accounts or passwords 64->100 102 Tries to steal Mail credentials (via file / registry access) 64->102 98 192.168.2.1 unknown unknown 77->98 104 Tries to harvest and steal browser information (history, passwords, etc) 77->104 80 WerFault.exe 77->80         started        signatures15 process16
Detection:
remcos
Create hunting rule
Link:
https://mwdb.cert.pl/sample/f0b85c3d890019c1d88274fb49f4caa52d696917a418ffee89324ad40d0076c9/
Threat name:
ByteCode-MSIL.Trojan.Taskun
Create hunting rule
Status:
Malicious
First seen:
2023-05-31 15:53:00 UTC
File Type:
PE (.Net Exe)
Extracted files:
12
AV detection:
22 of 37 (59.46%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6c4fypmjaam4dwecot5ut5gkuuwws2ixuqmp73ujgjfnidiao3eq._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
39f961f5b49ef78a9cb32548c8941dda6202da28953ce7013f5d8d3b49a69f48
RemcosRAT
43c39e05ae59835e16df8bd732cd035292db70bc2c2d6d95ac354622bfa376ec
RemcosRAT
4708bada9bbf77daade9a3f124eb0f5309ea68bba94c5bb4b332701d1d010185
RemcosRAT
631c5e9fd885b9265351f4be1562ed151d7c8c0a9ed30ddae5614d8091174ab7
RemcosRAT
70a8411f742d339d6af92b960c43c2adf6334f53d47026c6de52c0dffac619af
RemcosRAT
85ca69302b422ba0c29e29ea68f250ad6db23721f15abe418097cdc6e815ad60
RemcosRAT
be06d327419c53584beff876b97e9620c5e47b1cdca45d895d059cc2ed3644f7
RemcosRAT
c533150826bd6cd5b29cc1ec1b552091e976f7ec10044796f947bc262023d9bf
RemcosRAT
d645c82038ed0caed9dfb2b13d0057e75205e4dfcfb448ebb7b7c6e2271e6079
RemcosRAT
f7dd22fb970ce053fe95c76ee3a57c846c14bd08187b1f8f2d1d56e19294df35
RemcosRAT
+ 4'342 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:remotehost collection persistence rat spyware stealer
Link:
https://tria.ge/reports/230608-nmpsdsfe5w/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook accounts
Adds Run key to start application
Checks computer location settings
Executes dropped EXE
Reads user/profile data of web browsers
NirSoft MailPassView
NirSoft WebBrowserPassView
Nirsoft
Remcos
Malware Config
C2 Extraction:
212.193.30.230:3330
Unpacked files
SH256 hash:
9b40929951f603e0764f220f5f3c50c76956452578a897034250b7ac328554ef
MD5 hash:
728b4d9c5f41515884ddb20c6ccbc073
SHA1 hash:
d672bf3d23ace8b6179091da4e8774a93a96ce28
Link:
https://www.unpac.me/results/457594b7-fca0-4b9d-ac0f-b9932502388a/
SH256 hash:
4d497885d792bb88d72d47820d3154987042d1f184ad904e69e4efbccfa50860
MD5 hash:
3fcc6a697c19e2d08d30c1a69f06bcc8
SHA1 hash:
ad56a6ad9aa532a97791d09c6d6145e7087a4610
Detections:
Remcos
Create hunting rule
win_remcos_auto
Create hunting rule
Link:
https://www.unpac.me/results/457594b7-fca0-4b9d-ac0f-b9932502388a/
Parent samples :
2010a7e1a136a9881ba4db4beb99088ea77ea2997d36e6d1d16fc696b34fda8b
f853dbba694560317f4d0673da02ae77afce25d7eb4dc62f02ed0f5c750ce861
6053c5c3a4202b8c2e6b2f176a99c980233f63024be06b67d3a30e2f0b4470f4
4fbb3bf81fa5622f4640afa65fcaa18cbf88da23e6018bda7d068408e9409c8a
f0b85c3d890019c1d88274fb49f4caa52d696917a418ffee89324ad40d0076c9
SH256 hash:
16c255190eaaf1b60ec7d07abcac5f614ea197cee2416ca9d01bb563c526c87d
MD5 hash:
fb4ed205b442f470bbf10913128efdcb
SHA1 hash:
9a0a4c5ae429769e3253a9a3daefa24270b87a5b
Link:
https://www.unpac.me/results/457594b7-fca0-4b9d-ac0f-b9932502388a/
Parent samples :
ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397
de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e
SH256 hash:
87caf20a826ebc749b6b2202ed2599cc581cf59a1ef204741eec4457a66b1c8c
MD5 hash:
3626ac89b7fd4d846ab921175c55f8af
SHA1 hash:
1efb2a3218446b34eb1735e871032cab066166aa
Link:
https://www.unpac.me/results/457594b7-fca0-4b9d-ac0f-b9932502388a/
SH256 hash:
aa55a49c4e26b6c0cfb3aa599f5cb5c6eae65e0a7884458e75614092d073cf5f
MD5 hash:
9d9bed3fb41b5b721aafd13220f48c73
SHA1 hash:
069c54846fffaf8ba3abc8f140a60dd9755ff20a
Link:
https://www.unpac.me/results/457594b7-fca0-4b9d-ac0f-b9932502388a/
SH256 hash:
f0b85c3d890019c1d88274fb49f4caa52d696917a418ffee89324ad40d0076c9
MD5 hash:
c54fea66c5150e6d924ca83f504c1aa4
SHA1 hash:
14bb12af44b33a9177bd38f22f970f7e3db80bc9
Link:
https://www.unpac.me/results/457594b7-fca0-4b9d-ac0f-b9932502388a/
Malware family:
Remcos
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/f0b85c3d8900/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f0b85c3d890019c1d88274fb49f4caa52d696917a418ffee89324ad40d0076c9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/396923/

Comments