MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f3646ac33546540137231400c43e90525e2bc6fad1ba2c27cb56466c65bd58b3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemcosRAT

Vendor detections: 14

Intelligence 14 IOCs 1 YARA 10 File information Comments

SHA256 hash:	f3646ac33546540137231400c43e90525e2bc6fad1ba2c27cb56466c65bd58b3
SHA3-384 hash:	580140b619f5e65cb85c455118f95e21d2ccad4467ea6c83c878b77586849f9040552f82be354a598ad1c07aca13df51
SHA1 hash:	47ebc0744e88fbe12876471b49f4df80195f428a
MD5 hash:	7119698425e2056d404e97b12ed5ca37
humanhash:	blue-east-cold-mars
File name:	7119698425e2056d404e97b12ed5ca37.exe
Download:	download sample
Signature	RemcosRAT Create hunting rule
File size:	8'779'776 bytes
First seen:	2024-12-19 22:40:17 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	d0efa8288bc8fcf1ae384debe93de6ac (2 x RemcosRAT)
ssdeep	98304:Gnbgpe4NdaEMybVR/XfJca1tzZdBTXuOMehkf9O:WUpe4qiJdxcg/
TLSH	T1BB966A72E102C846D92501BFE829EAFC42196F38CB3795CB56C8FE1E3173AE20575A57
TrID	38.6% (.DLL) foobar 2000 generic component (102066/2/5) 29.5% (.DLL) foobar 2000 Diskwriter output component (78066/2/3) 21.8% (.CPL) Windows Control Panel Item (generic) (57583/11/19) 3.9% (.EXE) Win64 Executable (generic) (10522/11/4) 1.9% (.EXE) Win16 NE executable (generic) (5038/12/1)
Magika	pebin
File icon (PE):
dhash icon	4dc8c0b296cc69b2 (2 x RemcosRAT, 1 x QuasarRAT)
Reporter	abuse_ch
Tags:	exe RAT RemcosRAT

abuse_ch

RemcosRAT C2:
181.131.217.244:3020

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
181.131.217.244:3020	https://threatfox.abuse.ch/ioc/1358660/

Intelligence

File Origin

# of uploads :

# of downloads :

447

Origin country :

Vendor Threat Intelligence

Malware family:

remcos

ID:

File name:

7119698425e2056d404e97b12ed5ca37.exe

Verdict:

Malicious activity

Analysis date:

2024-12-19 22:44:33 UTC

Tags:

rat remcos evasion

Link:

https://app.any.run/tasks/5f1822c4-84de-48d1-8507-62944ab3b035

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

PUA.Win.Packer.Armadillo-98

Verdict:

Malicious

Score:

90.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6764a1028a4d48ee35fd2486

Tags:

ransomware shellcode dropper

Result

Verdict:

Malware

Maliciousness:

Behaviour

Unauthorized injection to a recently created process

Restart of the analyzed sample

Сreating synchronization primitives

Setting a keyboard event handler

DNS request

Connection attempt

Sending a custom TCP request

Sending an HTTP GET request

Creating a file

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

adaptive-context crypto expand explorer fingerprint keylogger lolbin microsoft_visual_cc remote

Link:

https://www.filescan.io/uploads/6764a0ff3bf0477cc1c04f64/reports/2b3b32d1-78ab-496b-8613-1e41e426b054/overview

Verdict:

Suspicious

Labled as:

Virus.Generic

Link:

https://www.hybrid-analysis.com/sample/f3646ac33546540137231400c43e90525e2bc6fad1ba2c27cb56466c65bd58b3

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/a858a9ce-fe87-4306-99a6-34bceec4461e

Result

Threat name:

Remcos

Detection:

malicious

Classification:

rans.troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1578616

Signature

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to bypass UAC (CMSTPLUA)

Contains functionality to register a low level keyboard hook

Contains functionality to steal Chrome passwords or cookies

Contains functionality to steal Firefox passwords or cookies

Contains functionalty to change the wallpaper

Delayed program exit found

Drops large PE files

Found malware configuration

Injects a PE file into a foreign processes

Installs a global keyboard hook

Malicious sample detected (through community Yara rule)

Suricata IDS alerts for network traffic

Yara detected Remcos RAT

Yara detected UAC Bypass using CMSTP

Behaviour

Behavior Graph:

Download SVG

Score:

45%

Verdict:

Susipicious

File Type:

Link:

https://malprob.io/report/f3646ac33546540137231400c43e90525e2bc6fad1ba2c27cb56466c65bd58b3

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f3646ac33546540137231400c43e90525e2bc6fad1ba2c27cb56466c65bd58b3/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=6nsgvqzvizkacnzdcqamipuqkjpcxrx22g5cyj6lkzdgyzn5lczq._file

Verdict:

malicious

Label(s):

remcos

Similar samples:

error

RemcosRAT

Result

Malware family:

remcos

Score:

10/10

Tags:

family:remcos botnet:rosas discovery persistence rat

Link:

https://tria.ge/reports/241219-2l3vhssmgr/

Behaviour

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

Adds Run key to start application

Remcos

Remcos family

Malware Config

C2 Extraction:

newstaticfreepoint24.ddns-ip.net:3020

Verdict:

Unknown

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/fc654b15-f348-4664-8dda-33b1e8e99b9b

Unpacked files

SH256 hash:

7653523efddbac3d3054ae04f93b97f5749ed092a69e503dea9863b4da109019

MD5 hash:

aa3b5da4a82bcbfe9432af0fc6772c4e

SHA1 hash:

17fe5aec12474c1b408ccbc0a55a2767dad8a8bd

Detections:

Remcos

win_remcos_auto

win_remcos_w0

malware_windows_remcos_rat

win_remcos_rat_unpacked

INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM

Link:

https://www.unpac.me/results/9aac8850-7e56-47d2-ba4e-710cc67c2ca4/

SH256 hash:

f3646ac33546540137231400c43e90525e2bc6fad1ba2c27cb56466c65bd58b3

MD5 hash:

7119698425e2056d404e97b12ed5ca37

SHA1 hash:

47ebc0744e88fbe12876471b49f4df80195f428a

Link:

https://www.unpac.me/results/9aac8850-7e56-47d2-ba4e-710cc67c2ca4/

Malware family:

Remcos

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/f3646ac33546/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	meth_stackstrings Create hunting rule
Author:	Willi Ballenthin

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	RansomPyShield_Antiransomware Create hunting rule
Author:	XiAnzheng
Description:	Check for Suspicious String and Import combination that Ransomware mostly abuse(can create FP)

Rule name:	u42_crime_win_heartcrypt Create hunting rule
Author:	Unit 42 Threat Intelligence
Description:	HeartCrypt PaaS hunting rule.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RemcosRAT

exe f3646ac33546540137231400c43e90525e2bc6fad1ba2c27cb56466c65bd58b3

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/3366184/

Delivery method

Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high

Reviews

ID	Capabilities	Evidence
COM_BASE_API	Can Download & Execute components	ole32.dll::CoCreateInstance ole32.dll::CreateStreamOnHGlobal
MULTIMEDIA_API	Can Play Multimedia	WINMM.dll::timeBeginPeriod WINMM.dll::timeEndPeriod WINMM.dll::timeGetTime
SHELL_API	Manipulates System Shell	SHELL32.dll::ShellExecuteExW
SS_API	Uses SS API	ADVAPI32.dll::CryptVerifySignatureW
WIN32_PROCESS_API	Can Create Process and Threads	KERNEL32.dll::CloseHandle
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess KERNEL32.dll::LoadLibraryW KERNEL32.dll::LoadLibraryExA KERNEL32.dll::LoadLibraryExW KERNEL32.dll::GetSystemInfo KERNEL32.dll::GetStartupInfoW
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::CopyFileW KERNEL32.dll::CreateFileW KERNEL32.dll::DeleteFileW KERNEL32.dll::MoveFileExW KERNEL32.dll::ReadDirectoryChangesW KERNEL32.dll::GetFileAttributesW
WIN_CRYPT_API	Uses Windows Crypt API	CRYPT32.dll::CertFreeCertificateChain CRYPT32.dll::CertFreeCertificateContext CRYPT32.dll::CertGetCertificateChain CRYPT32.dll::CertVerifyCertificateChainPolicy CRYPT32.dll::CertVerifyRevocation CRYPT32.dll::CertVerifyTimeValidity
WIN_REG_API	Can Manipulate Windows Registry	ADVAPI32.dll::RegCreateKeyW ADVAPI32.dll::RegGetValueW ADVAPI32.dll::RegOpenKeyW ADVAPI32.dll::RegOpenKeyExW ADVAPI32.dll::RegQueryInfoKeyW ADVAPI32.dll::RegQueryValueExW
WIN_USER_API	Performs GUI Actions	USER32.dll::AppendMenuW USER32.dll::EmptyClipboard USER32.dll::OpenClipboard USER32.dll::PeekMessageW USER32.dll::CreateWindowExW

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample