MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fd81af867988782d16df1b79f602163f297ebb1631f4d1542c4828d0fb5a7900. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 11


Intelligence 11 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fd81af867988782d16df1b79f602163f297ebb1631f4d1542c4828d0fb5a7900
SHA3-384 hash: 4da0490322a16684e6a6f78925f7a7a608c313f1d66547b5ccf051cd668498a00ad336b9bb4c3d59abc2f4d1a386cf44
SHA1 hash: 1f452e0b6cdab5174032bd77ba09095888070937
MD5 hash: 98c997622adf2a1c84f0faf8942105ec
humanhash: washington-lamp-robert-fillet
File name:Factura Serfinanza_04273223569_30395902_1006652650536563_8073732_235116358454209861_598171199562_pdf.exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:136'704 bytes
First seen:2021-04-27 08:29:09 UTC
Last seen:2021-04-27 10:13:54 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'607 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 1536:ZPV4uR8RGqR6Wv3m5j66625rHcAlzM1KonIwKg3o4OrS1zf23B9Yu98A5yNCB0f:BV4uKlpv3yj66BHcoWhn8g3o4yysB6
Threatray 1'836 similar samples on MalwareBazaar
TLSH C1D33AB8FC48F531C2D90FB98013C4B852FDDAB61C205544A1B06F6DCB6AA86B975CF6
Reporter abuse_ch
Tags:exe RemcosRAT

Intelligence

File Origin
# of uploads :
2
# of downloads :
155
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
50a6a04c-f88c-459b-8a5b-c5c84e2a3bc4
Verdict:
Malicious activity
Analysis date:
2021-04-27 08:39:26 UTC
Tags:
trojan dtloader loader
Link:
https://app.any.run/tasks/729a22fd-4ca3-41eb-86a4-a67c7feca265

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/144483/
Detection(s):
SecuriteInfo.com.Artemis98C997622ADF.24603.7312.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Sending an HTTP GET request
Creating a file
Moving a recently created file
Creating a file in the %temp% subdirectories
Creating a process from a recently created file
Creating a process with a hidden window
Launching a service
Sending a UDP request
Deleting a recently created file
Launching a process
Running batch commands
Unauthorized injection to a recently created process
Adding exclusions to Windows Defender
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/3c5a1950-a30e-4838-84ff-4f293eeef85e
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/698722
Signature
Adds a directory exclusion to Windows Defender
C2 URLs / IPs found in malware configuration
Detected Remcos RAT
Found malware configuration
Hides threads from debuggers
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Writes to foreign memory regions
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 398275 Sample: 9562_pdf.exe Startdate: 27/04/2021 Architecture: WINDOWS Score: 100 39 Found malware configuration 2->39 41 Malicious sample detected (through community Yara rule) 2->41 43 Detected Remcos RAT 2->43 45 4 other signatures 2->45 7 9562_pdf.exe 21 13 2->7         started        process3 dnsIp4 37 ldvamlwhdpetnyn.ml 104.21.85.176, 49725, 80 CLOUDFLARENETUS United States 7->37 29 C:\Users\user\AppData\...\os1fhowl.newcfg, ASCII 7->29 dropped 31 C:\Users\user\AppData\...\n0eg01wa.newcfg, XML 7->31 dropped 33 C:\Users\user\AppData\...\AdvancedRun.exe, PE32 7->33 dropped 47 Writes to foreign memory regions 7->47 49 Adds a directory exclusion to Windows Defender 7->49 51 Hides threads from debuggers 7->51 53 Injects a PE file into a foreign processes 7->53 12 cmd.exe 7->12         started        14 powershell.exe 26 7->14         started        16 AdvancedRun.exe 1 7->16         started        18 22 other processes 7->18 file5 signatures6 process7 dnsIp8 21 conhost.exe 12->21         started        23 timeout.exe 12->23         started        25 conhost.exe 14->25         started        27 AdvancedRun.exe 16->27         started        35 192.168.2.1 unknown unknown 18->35 process9
Detection:
remcos
Create hunting rule
Link:
https://mwdb.cert.pl/sample/fd81af867988782d16df1b79f602163f297ebb1631f4d1542c4828d0fb5a7900/
Threat name:
ByteCode-MSIL.Trojan.Foold
Create hunting rule
Status:
Malicious
First seen:
2021-04-27 08:30:14 UTC
AV detection:
4 of 47 (8.51%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7wa27btzrb4c2fw7dn47maqwh4ux5oywgh2ncvbmjaunb622peaa._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
126f752c7dec6c513804a0737e5d0a03cd8a1082923d68aec35979f3a7db7d60
RemcosRAT
174d9ba2e89f897d84a612d59117d349773c91f129aa8cdb8ad8a29d576fa8af
RemcosRAT
321b6f97457bc64a7fa264043d5f7ce3b6dc1ddd735daf77820580b2f7ff7a93
RemcosRAT
337a895245dcdbe522c4320dbe1dfd62e346aecad8246f9b895a5460211865b0
RemcosRAT
360dc7aa2889b1ed05b553eccab73348de2fae89cd7742e64422712298b670ca
RemcosRAT
3781825b53e1bcc9ba8bd6790b399bda60bfc588e980670c54b98b852d639d94
RemcosRAT
5242c4552e512707dbeb3b004cb441cc140b6cfe813a4d6532f4adec03bcb23c
RemcosRAT
6721200d1e880c83cf3c4ee07db918abca886251cd59a10c10b515eaf026bbbc
RemcosRAT
92aaa412fd4384f56646d3b70ae7e8f4e26e436501ac61b9dd29652162a2997c
RemcosRAT
dadf9503f7ab1f7c789e7c8cc109a06eef7afe8769bb669c2679e4556bd85620
RemcosRAT
+ 1'826 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos evasion rat trojan
Link:
https://tria.ge/reports/210427-gx3ln28p8e/
Behaviour
Delays execution with timeout.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Loads dropped DLL
Windows security modification
Executes dropped EXE
Nirsoft
Modifies Windows Defender Real-time Protection settings
Remcos
Turns off Windows Defender SpyNet reporting
Windows security bypass
Malware Config
C2 Extraction:
databasepropersonombrecomercialideasearchwords.services:3521
Unpacked files
SH256 hash:
fd81af867988782d16df1b79f602163f297ebb1631f4d1542c4828d0fb5a7900
MD5 hash:
98c997622adf2a1c84f0faf8942105ec
SHA1 hash:
1f452e0b6cdab5174032bd77ba09095888070937
Link:
https://www.unpac.me/results/e058bded-06d3-409e-b5df-600feafdeeda/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/fd81af867988782d16df1b79f602163f297ebb1631f4d1542c4828d0fb5a7900

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/144483/

Comments