MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fc0d7eec3016c127377cda75973d9b4690780f4e651210b41d86e8bfd7103b1a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	fc0d7eec3016c127377cda75973d9b4690780f4e651210b41d86e8bfd7103b1a
SHA3-384 hash:	3810a570739607d000d680ab5bccda3b2a1f2e51a45bfbbfdf5bec02fb65f3bba24049689d56e3f94ecf237e53a7c0df
SHA1 hash:	f0c6654c1a8f74fd4771cebea78ff91508307ac4
MD5 hash:	bd52f7a13aed1b9c15db012d98964c2c
humanhash:	oklahoma-moon-lion-colorado
File name:	Microsoftdecidedtodeleteentirehistorycachecookieeverythingfromthepc.Doc
Download:	download sample
Signature	RemcosRAT Alert Create hunting rule
File size:	63'152 bytes
First seen:	2023-12-19 00:04:58 UTC
Last seen:	Never
File type:	doc
MIME type:	text/plain
ssdeep	1536:QcxUlosaTnhk3MMVRMAIER46GFV0MLr/oFzcVKHhu:QgU9aiAAIER46zurQEKHhu
TLSH	T10053666A774E4D29E765E6778159894E4AFCF73A72C240C0FABCA3743B3D40E8A61074
Reporter	adm1n_usa32
Tags:	CVE-2017-11882 doc RemcosRAT

adm1n_usa32

what a file name lol

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

351

Origin country :

RO

Vendor Threat Intelligence

ANY.RUN remcos

Malware family:

remcos

Alert

Create hunting rule

ID:

1

File name:

PURCHASE ORDER1 & 2.xls

Verdict:

Malicious activity

Analysis date:

2023-12-18 18:56:55 UTC

Tags:

phishing phishing-xls rat remcos remote exploit cve-2017-11882 loader stealer

Link:

https://app.any.run/tasks/5dcd0c64-8e83-4621-a7d1-9332ba81ed40

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

ClamAV Detected

Detection(s):

SecuriteInfo.com.Spam-473.UNOFFICIAL

Alert

Create hunting rule

Sanesecurity.Malware.27333.RtfHeur.BadVer.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.FakeRTF-1.UNOFFICIAL

Alert

Create hunting rule

Sanesecurity.Malware.26244.RtfHeur.UNOFFICIAL

Alert

Create hunting rule

Sanesecurity.Shelter.Malware.BadRtf.ObjUpd.UNOFFICIAL

Alert

Create hunting rule

MiscreantPunch.RTF.EvilRTF.CVE-2017-0199-Obfus.UNOFFICIAL

Alert

Create hunting rule

TwinWave.EvilDoc.RTFFakeVersionWithObjUpdateUKSurfMix.20200514.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Searching for synchronization primitives

Creating a window

Сreating synchronization primitives

Launching a process

Creating a file in the %AppData% directory

Creating a file in the %temp% directory

Creating a file in the %AppData% subdirectories

DNS request

Sending a custom TCP request

Reading critical registry keys

Sending an HTTP GET request

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Unauthorized injection to a recently created process by context flags manipulation

Unauthorized injection to a recently created process

Stealing user critical data

Creating a process from a recently created file

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

control embedequation exploit javascript lolbin masquerade shell32 shellcode

Link:

https://www.filescan.io/uploads/6580de31f4b6e5e1634f89ad/reports/ac0f3d92-543a-400b-8a45-33cb025e7f2b/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/fc0d7eec3016c127377cda75973d9b4690780f4e651210b41d86e8bfd7103b1a

Joe Sandbox Remcos

Result

Threat name:

Remcos

Alert

Create hunting rule

Detection:

malicious

Classification:

rans.phis.troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1364327

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Contains functionality to bypass UAC (CMSTPLUA)

Contains functionality to inject code into remote processes

Contains functionality to modify clipboard data

Contains functionality to register a low level keyboard hook

Contains functionality to steal Chrome passwords or cookies

Contains functionality to steal Firefox passwords or cookies

Contains functionalty to change the wallpaper

Delayed program exit found

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found malware configuration

Initial sample is an obfuscated RTF file

Machine Learning detection for dropped file

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Office equation editor drops PE file

Office equation editor establishes network connection

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

Searches for Windows Mail specific files

Shellcode detected

Sigma detected: EQNEDT32.EXE connecting to internet

Sigma detected: File Dropped By EQNEDT32EXE

Sigma detected: Remcos

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Instant Messenger accounts or passwords

Tries to steal Mail credentials (via file / registry access)

Tries to steal Mail credentials (via file registry)

Yara detected Remcos RAT

Yara detected UAC Bypass using CMSTP

Yara detected WebBrowserPassView password recovery tool

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

99%

Verdict:

Malware

File Type:

ASCII

Link:

https://malprob.io/report/fc0d7eec3016c127377cda75973d9b4690780f4e651210b41d86e8bfd7103b1a

CERT.PL MWDB cve-2017-11882-shellcode

Detection:

cve-2017-11882-shellcode

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/fc0d7eec3016c127377cda75973d9b4690780f4e651210b41d86e8bfd7103b1a/

ReversingLabs TitaniumCloud Document-RTF.Exploit.CVE-2017-11882

Threat name:

Document-RTF.Exploit.CVE-2017-11882

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-12-18 19:19:51 UTC

File Type:

Document

Extracted files:

4

AV detection:

20 of 37 (54.05%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7qgx53bqc3ason343j2zopm3i2ihqd2omujbbna5q3ul7vyqhmna._file

VMRay Remcos

Malware family:

Remcos

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/fc0d7eec3016/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/fc0d7eec3016c127377cda75973d9b4690780f4e651210b41d86e8bfd7103b1a

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RemcosRAT

doc fc0d7eec3016c127377cda75973d9b4690780f4e651210b41d86e8bfd7103b1a

(this sample)

any.run

https://app.any.run/tasks/9fb9bad4-8f76-4116-991d-34e23de0342b

  

URLhaus

https://urlhaus.abuse.ch/url/2741984/

  

Delivery method

Distributed via web download