MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f5231414600e6239f0928f88a018e349d0856aa14b133905ab8fa05b6288d225. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 12


Intelligence 12 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f5231414600e6239f0928f88a018e349d0856aa14b133905ab8fa05b6288d225
SHA3-384 hash: 4d76e1850add42cf24f4a218c4f2a3537d73f4a1d7d88158b39137c46eecbbb00ae3e35da45867fb9b827e781aaef93a
SHA1 hash: 0f14cc20a764a431c9522585037170e55dfe0d64
MD5 hash: 8595f4d3b0f77f0b34b575fd4e8d89e3
humanhash: twenty-lemon-wyoming-seven
File name:pre alert notice.exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:65'536 bytes
First seen:2023-02-06 14:42:44 UTC
Last seen:2023-02-09 13:32:51 UTC
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 768:M0OGy94wjvuLm0DNOD9I840O/KeSHs40LO6dusn04eZ:JOd94wjvuL9a9I84us40ymuL3Z
Threatray 1'066 similar samples on MalwareBazaar
TLSH T145539127DC6C42EAFA2D46BC401652441FF735E7F636DF4A5BB56C88CC823120926E9B
TrID 44.4% (.EXE) Win64 Executable (generic) (10523/12/4)
21.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
8.7% (.ICL) Windows Icons Library (generic) (2059/9)
8.5% (.EXE) OS/2 Executable (generic) (2029/13)
8.4% (.EXE) Generic Win/DOS Executable (2002/3)
Reporter James_inthe_box
Tags:exe RemcosRAT

Intelligence

File Origin
# of uploads :
4
# of downloads :
193
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
remcos
Create hunting rule
ID:
1
File name:
pre alert notice.exe
Verdict:
Malicious activity
Analysis date:
2023-02-06 14:44:07 UTC
Tags:
rat remcos
Link:
https://app.any.run/tasks/56ebf64a-3795-43ef-accc-2bd106961568

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/360924/
Detection(s):
Sanesecurity.Rogue.0hr.20230206-0236.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a custom TCP request
Launching a process
Creating a file
Сreating synchronization primitives
DNS request
Sending an HTTP GET request
Forced shutdown of a system process
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
kryptocibule
Link:
https://www.filescan.io/uploads/63e111f889bd67c10fdcc849/reports/282f09d6-d3f7-4412-9e86-61ad58b79456/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/f5231414600e6239f0928f88a018e349d0856aa14b133905ab8fa05b6288d225
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
REMCOS
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/7728959e-5790-4f5e-997b-7ee6fc620351
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1166888
Signature
.NET source code references suspicious native API functions
C2 URLs / IPs found in malware configuration
Contains functionality to bypass UAC (CMSTPLUA)
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Delayed program exit found
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sigma detected: Remcos
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected Remcos RAT
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f5231414600e6239f0928f88a018e349d0856aa14b133905ab8fa05b6288d225/
Threat name:
ByteCode-MSIL.Trojan.Injuke
Create hunting rule
Status:
Malicious
First seen:
2023-02-06 00:03:16 UTC
File Type:
PE+ (.Net Exe)
Extracted files:
7
AV detection:
21 of 26 (80.77%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6urrifdabzrdt4esr6ekaghdjhiik2vbjmjtsbnlr6qfwyui2isq._file
Verdict:
unknown
Similar samples:
101387858898c5dc0102bfd2b57fe50707dd002c093a4dc596bf3e7e854f6880
RemcosRAT
6326bea9cec6e2baec63ed96cd31a97770c6a63b96d1169a8b5586ec071c8778
RemcosRAT
65a2b3cf112d50e941051116e68b736239d521bf7611e143ae1c83f93716f6f5
RemcosRAT
8cd3a69637a14aeb7a0db8c47a197e8cdee48d1c995b8ea848449b1f206a8d24
RemcosRAT
9a2232a4a9ceef2c3fcfee0acca71d5717395aff8abd1b6b26aa3a5c266b3fae
RemcosRAT
a7555fbbb59c9e063dfa6b392af01c02f1d23679e53882fc1cb6d3a432330c50
RemcosRAT
b9f48f05b6f1651f58be0210fb474c75cdd8ed3ea88d013b5d0f755681d13934
RemcosRAT
c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004
RemcosRAT
d4ee1c1713c6d964cdcf4b3d561322f78be458bc14b0c257b69eba2b441a07b6
RemcosRAT
d86a220dd6b7e1a43947be099a9b33a837ad61086cbd00cba7e730b54cabbfc5
RemcosRAT
+ 1'056 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:remotehost rat
Link:
https://tria.ge/reports/230206-r3mvhshf8x/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Remcos
Malware Config
C2 Extraction:
45.87.61.104:3033
Unpacked files
SH256 hash:
f5231414600e6239f0928f88a018e349d0856aa14b133905ab8fa05b6288d225
MD5 hash:
8595f4d3b0f77f0b34b575fd4e8d89e3
SHA1 hash:
0f14cc20a764a431c9522585037170e55dfe0d64
Link:
https://www.unpac.me/results/ebdab03b-1820-4798-9819-738bf426fff5/
Malware family:
Remcos
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/f5231414600e/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/f5231414600e6239f0928f88a018e349d0856aa14b133905ab8fa05b6288d225

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

zip 3943babda7a93e6cc1991da15cdb36c87180f58ea34ba94b525ff321b5cf23fc

RemcosRAT

Executable exe f5231414600e6239f0928f88a018e349d0856aa14b133905ab8fa05b6288d225

(this sample)

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/360924/
  
Dropped by
SHA256 3943babda7a93e6cc1991da15cdb36c87180f58ea34ba94b525ff321b5cf23fc
  
Dropped by
MD5 9b3562cc4c78496d71a498fe8be8e2d8

Comments