MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 f2643b4686b59c10dd7e51a8482f5515f15ab47eb81b6d8674b135c7ea266d24. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
RemcosRAT
Vendor detections: 17
| SHA256 hash: | f2643b4686b59c10dd7e51a8482f5515f15ab47eb81b6d8674b135c7ea266d24 |
|---|---|
| SHA3-384 hash: | 8d7358c29ac9f9fbd173516601d24081e6712d47d9dc993a94f1dc28bec0533e916d68d15a96a37c860ff0f0c75a3318 |
| SHA1 hash: | e89224a9007e970775765d10531b0b4745d89bd8 |
| MD5 hash: | 2552ee4ef6ff571f4791942deca0d55f |
| humanhash: | glucose-louisiana-cold-potato |
| File name: | 2552ee4ef6ff571f4791942deca0d55f |
| Download: | download sample |
| Signature | RemcosRAT |
| File size: | 1'222'656 bytes |
| First seen: | 2022-11-26 17:02:39 UTC |
| Last seen: | 2022-11-26 18:29:13 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'606 x Formbook, 12'242 x SnakeKeylogger) |
| ssdeep | 24576:ucCsMgnxZWnVxBTiaXrfoSs9IqoUF5arrK5fJKt0EDxobyoOZ:ucRxZWVxBDTvsRoUF5jfJ3DhO |
| Threatray | 2'273 similar samples on MalwareBazaar |
| TLSH | T17345333792603A38DC1F4A7ABF9E7A348D2DB887D1A57249303C27986B1EC7127421DC |
| TrID | 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10523/12/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4505/5/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9) |
| Reporter |  zbetcheckin |
| Tags: | 32 exe RemcosRAT |
Intelligence
File Origin
# of uploads :
2
# of downloads :
253
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
raccoon
ID:
1
File name:
6ef647cfe131f11e48e3acfd2b52595d.exe
Verdict:
Malicious activity
Analysis date:
2022-11-26 16:21:56 UTC
Tags:
trojan raccoon recordbreaker loader stealer rat azorult remcos
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Remcos
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Сreating synchronization primitives
Running batch commands
Creating a process with a hidden window
Creating a file in the %AppData% subdirectories
Unauthorized injection to a recently created process
Creating a file
Setting a keyboard event handler
DNS request
Launching a process
Enabling the 'hidden' option for recently created files
Using the Windows Management Instrumentation requests
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
bladabindi obfuscated packed
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
REMCOS
Verdict:
Malicious
Result
Threat name:
Remcos
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Connects to many ports of the same IP (likely port scanning)
Encrypted powershell cmdline option found
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Threat name:
ByteCode-MSIL.Backdoor.Bladabhindi
Status:
Malicious
First seen:
2022-11-26 17:03:10 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
17 of 26 (65.38%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
remcos
Similar samples:
+ 2'263 additional samples on MalwareBazaar
Result
Malware family:
remcos
Score:
10/10
Tags:
family:remcos botnet:11262022 persistence rat
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Checks computer location settings
Remcos
Malware Config
C2 Extraction:
nikahuve.ac.ug:65214
kalskala.ac.ug:65214
tuekisaa.ac.ug:65214
parthaha.ac.ug:65214
kalskala.ac.ug:65214
tuekisaa.ac.ug:65214
parthaha.ac.ug:65214
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Unpacked files
SH256 hash:
d673d6ac1e46c2c80552c4ad03a881f333c0645827ff686f27e5965186a4a253
MD5 hash:
25d60ba3f97b7d4037b0d7bfc3a95165
SHA1 hash:
f67cb04418389f03256c4bd8221d9ec2a2b2c2ea
Detections:
Remcos
win_remcos_auto
SH256 hash:
dc1fd469d7cdb329c5051d1308764ae41a4d0002528382e605030c797ac27352
MD5 hash:
6264bcec2d524eb84a2e2f910d042fc4
SHA1 hash:
f1905a2d26fb48a527ad63ed0893d02372f37f26
SH256 hash:
8ffa39aae908e30501361803091d323dec2fc7757fede9fabbc67261aaef1d75
MD5 hash:
4295e2f8dbf1da0134f49b8eb8917133
SHA1 hash:
4b9c02f7ad4b5f698873f95a2d4034c2360dd0f7
SH256 hash:
f2643b4686b59c10dd7e51a8482f5515f15ab47eb81b6d8674b135c7ea266d24
MD5 hash:
2552ee4ef6ff571f4791942deca0d55f
SHA1 hash:
e89224a9007e970775765d10531b0b4745d89bd8
Malware family:
Remcos
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | INDICATOR_EXE_Packed_SmartAssembly |
|---|---|
| Author: | ditekSHen |
| Description: | Detects executables packed with SmartAssembly |
| Rule name: | INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer |
|---|---|
| Author: | ditekSHen |
| Description: | detects Windows exceutables potentially bypassing UAC using eventvwr.exe |
| Rule name: | pe_imphash |
|---|
| Rule name: | Remcos |
|---|---|
| Author: | kevoreilly |
| Description: | Remcos Payload |
| Rule name: | REMCOS_RAT_variants |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
| Rule name: | Windows_Trojan_Remcos_b296e965 |
|---|---|
| Author: | Elastic Security |
| Rule name: | win_remcos_auto |
|---|---|
| Author: | Felix Bilstein - yara-signator at cocacoding dot com |
| Description: | Detects win.remcos. |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.url : hxxp://paldo.ac.ug/rc.exe