MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ffb6236e6dd03ba2599326f3d83d2ffabf8ab18902f1865aa0a68f1881e31978. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 11


Intelligence 11 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ffb6236e6dd03ba2599326f3d83d2ffabf8ab18902f1865aa0a68f1881e31978
SHA3-384 hash: b6e1da67cdf856d1cddfadda3e20e83d089538d178e371ff339d6f3336eb78f3fd0b76b64cfa31ec82ef3fb3d33b83f8
SHA1 hash: c5bd17048992a4a51a6e9b43f6d6492c77554c98
MD5 hash: adb90e4d6fbfc7c1d4c9a7415ccf2eb4
humanhash: cardinal-dakota-carpet-montana
File name:MTSMEXP-30012021,pdf.scr
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:813'568 bytes
First seen:2021-10-14 07:52:25 UTC
Last seen:2021-10-14 12:27:43 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 978fa6788aee75614efce16a9b593468 (3 x RemcosRAT, 2 x Formbook, 1 x RedLineStealer)
ssdeep 12288:ZV17shYPLAsHSU8Qrn47tremr8bP/xz4Hr7+MBtI+BfZ8fQO:ZfwYxHSyMreg0P94HPtBZ8I
Threatray 830 similar samples on MalwareBazaar
TLSH T16D056D26ADDD09AAD57628B52C1B7DA0D83DE97039307C790ED50988CF3B721743A1EE
File icon (PE):PE icon
dhash icon acacacb6a2968eaa (13 x RemcosRAT, 4 x Formbook, 4 x AveMariaRAT)
Reporter GovCERT_CH
Tags:exe RemcosRAT

Intelligence

File Origin
# of uploads :
3
# of downloads :
176
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
MTSMEXP-30012021,pdf.scr
Verdict:
Malicious activity
Analysis date:
2021-10-14 07:59:30 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/fe57a744-d6db-4deb-bd44-5b4985ebe4d7

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/197443/
Detection(s):
SecuriteInfo.com.Trojan.DownLoader43.44051.6890.31365.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
keylogger
Link:
https://www.filescan.io/uploads/6167e1e39fb4d8593d649500/reports/e2b0b89c-175a-4a32-8cf9-4b2ce33d6ad2/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Dbatloader
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/76ff8b3f-31b6-4969-9a39-72dd87cc85ae
Result
Threat name:
Remcos DBatLoader
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/870263
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Creates a thread in another existing process (thread injection)
Delayed program exit found
Detected Remcos RAT
Found malware configuration
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Writes to foreign memory regions
Yara detected DBatLoader
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ffb6236e6dd03ba2599326f3d83d2ffabf8ab18902f1865aa0a68f1881e31978/
Threat name:
Win32.Trojan.Woreflint
Create hunting rule
Status:
Malicious
First seen:
2021-10-14 06:27:36 UTC
AV detection:
6 of 43 (13.95%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=763cg3tn2a52ewmte3z5qpjp7k7yvmmjalyymwvau2hrrapddf4a._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
1730338ca0fbfe0985bed5638fc8599a6dd38761ab8b89e3d8a076947a320028
RemcosRAT
49cb5b15b21ecd89b7462da8008c6c49d32310858912344f11fa04dab67f1f3a
RemcosRAT
502f18997fa73c5af97c3f8f3cd7a8a12d7d648642bd238b4eb15c0457e879a1
RemcosRAT
5e1473cb44990bf7a1d8da8ad410642430bc6c5663859bc4e4c738e22b3cc71e
RemcosRAT
8665814a84a6e826c9b23c2e5f177f1fbcde7736f8b66e419eb4d0cf4b1a0f68
RemcosRAT
a97b00620e1e8ef9ef5c5f922f5b40ecf698504402d3e14979701c330bef7b56
RemcosRAT
b3e18d1026779e01b6bc834a8da488eeb669e5e366ef8d495c109c0f1424d3c1
RemcosRAT
b9c5a6059ee5150b5837e446196c4349571d80336b438056f687d7044cd246b9
RemcosRAT
cd43f136f1d3221cd64fc792a37744dfa9656a9ea5889e52929275c05eb4e33b
RemcosRAT
+ 820 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:bg persistence rat
Link:
https://tria.ge/reports/211014-jq1a3sgfb5/
Behaviour
Modifies system certificate store
Suspicious use of WriteProcessMemory
Adds Run key to start application
Remcos
Malware Config
C2 Extraction:
Officialsw.chickenkiller.com:2310
official.ydns.eu:2310
hurricane.ydns.eu:2310
Unpacked files
SH256 hash:
18d5f2bb4c00c8e6fb62f43bc3878c615b600ec26bc25b98204cc2e945cd175a
MD5 hash:
b0d9d156b07f2199b3334fc6564c133d
SHA1 hash:
0c39614273b857121740e0142d1d9809de8bc41b
Detections:
win_unidentified_086_w0
Create hunting rule
Link:
https://www.unpac.me/results/2d8625d3-1171-43a6-bcae-61862e54a3de/
Parent samples :
b400601e35e72a20ca4a0fb19af7a93ddeddcd568674232cabb6c1e05ce4fd07
a643235802bd118331000b4a251952815382078dd0aaaded76e4a8890bbac5f6
33b01cf0eb422d872201670e34b732f76c980ae7ccb016068438272ed426a50b
fe6bd626fd98e3c0e4a2c350e5d927398e22e7731e7c2e1f31bc02181735c4e0
a97b00620e1e8ef9ef5c5f922f5b40ecf698504402d3e14979701c330bef7b56
90e1eac40edda005fffadbb1d16c652d16e685f8f4cf7375eb6ac928222c3a1c
1e54beecbd654f17bab2c6f883ea089943d68ae3e49aaea079182173dc203297
a0703367806de16bac9c75c016780c0bf3b1d8c21cf7f51b6a47b6a1aba74999
1ed62fd139d5efe1cb2650f52cf405d615dc19dae62744df9fb364cd1970a4bc
ffb6236e6dd03ba2599326f3d83d2ffabf8ab18902f1865aa0a68f1881e31978
99cdf3421923232c160c5075af3bf8620df65bd59cf99cc341f17a58e1eeb4f2
8f1eefd14608fae865576d9f7a24be116eb9d8dcebf89c954e2e645b06174c4e
f86258665b68d70e83397ac4ef17598c552b994dd13f26b8208c4d40b8e94816
ed78db064dfb4ae791498b2d08410a69bdad684ff709319d179c2383dd8e2f1c
3490cb5fd9a372722f95ed69c41e23d5cd274ce6b3c024ec1731962a380409d6
d86532a631143032da8dd4e4fd86cbaed87777ef2ede4a60377d534cb9ea7271
298d542746dfa4922dd5fbc8fab572be58447c9dbd1481c55bd2254bb275684f
ffb0bd5cf5a1716fa50f01a4b4fd98d396842c7c263d3ce03623748430b30a93
a2067e35b12b83ddae55145931870302de477b5ccce82a5e86ea7bf8e057d8d7
a2539269c2b9200d7baed9f0dfc25b59fd4713a641d79fd9bd13272c7e1296ca
0aff281c192e919ce8a4e2091a058aa3c8fab2379dd50d7dd7ac7217af4dc838
cc8b096d71a4734e17e6f1bcf10d9730e5a2b3ab15b7e89852a4cdd204563d29
1e24e03e9ffdbe39ca8d357d0130aff5c50f2ddd7b2f613ab9dc01f02d0527d3
f60b6dfcaf466a9cf6b7831fcd74abc70efc16aec11d3b38fdbc7562003ba61b
67c445ff181fcaa6b46a1d1af78a9df1ac413593f29561e4fa43059c7ed85ace
SH256 hash:
ffb6236e6dd03ba2599326f3d83d2ffabf8ab18902f1865aa0a68f1881e31978
MD5 hash:
adb90e4d6fbfc7c1d4c9a7415ccf2eb4
SHA1 hash:
c5bd17048992a4a51a6e9b43f6d6492c77554c98
Link:
https://www.unpac.me/results/2d8625d3-1171-43a6-bcae-61862e54a3de/
Malware family:
Remcos
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/ffb6236e6dd0/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.44
Link:
https://yomi.yoroi.company/submissions/ffb6236e6dd03ba2599326f3d83d2ffabf8ab18902f1865aa0a68f1881e31978

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

Executable exe ffb6236e6dd03ba2599326f3d83d2ffabf8ab18902f1865aa0a68f1881e31978

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/197443/

Comments