Remote20Access-windows64-online[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Remote20Access-windows64-online.exe
Size 1.5MB
Sample260629-2wlc8aas5r
SHA256 c75e376d708b4e3f8bfe1e4c7515d30dc6475297cef8bd60270bbe41df6e2b8c
MD5 3d117efdaa94d3c45ac2670db7c5840b
SHA1 01cefc8911d6f99b2919d36e87272f18fb4d3dc4
SHA512 ac99124915f18a4c9bf8438204f741e00547a45e100674ba38fd8eea783669e20b441ae4b31cd921edfae3bbb0ef17eb35be858d42629505417bd1d26e0b4083
SSDEEP 49152:8aHqbMGOOMRQiornb2fvpOeN3zeeTXqhqTReleGz:NTd2ihfvpOeqhd
TLSH
T12E750266F3A758F5C8B7C038CA928763EB757059032463D713A08A2A6F377E4663E741
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

revoked_codesign backdoor rat

Malware Config

Signatures

Revoked Certificate in Chain 1 IoCs

One or more certificates in the signing chain have been revoked, indicating potential compromise.

revoked_codesign

resource
Remote20Access-windows64-online.exe

SimpleHelp remote administration tool 1 IoCs

SimpleHelp is a remote administration tool that can be used as a backdoor

backdoor rat

resource	yara_rule
sample	rat_simplehelp

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
Remote20Access-windows64-online.exe

File Explorer

Remote20Access-windows64-online.exe

.exe 1.5MB

Remote20Access-windows64-online.exe

IMPHASH 4dcdd102066c792bcf91dce0ad10afac
SHA256 c75e376d708b4e3f8bfe1e4c7515d30dc6475297cef8bd60270bbe41df6e2b8c
MD5 3d117efdaa94d3c45ac2670db7c5840b
SHA1 01cefc8911d6f99b2919d36e87272f18fb4d3dc4
SHA512 ac99124915f18a4c9bf8438204f741e00547a45e100674ba38fd8eea783669e20b441ae4b31cd921edfae3bbb0ef17eb35be858d42629505417bd1d26e0b4083
SSDEEP 49152:8aHqbMGOOMRQiornb2fvpOeN3zeeTXqhqTReleGz:NTd2ihfvpOeqhd
TLSH
T12E750266F3A758F5C8B7C038CA928763EB757059032463D713A08A2A6F377E4663E741
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Revoked Certificate in Chain

One or more certificates in the signing chain have been revoked, indicating potential compromise.

revoked_codesign
SimpleHelp remote administration tool

SimpleHelp is a remote administration tool that can be used as a backdoor

backdoor rat
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

bb:7c:69:d1:99:56:01:31:c6:e5:19:c8:9b:a5:99:02:12:42:a3:7e

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=SimpleHelp Ltd,O=SimpleHelp Ltd,L=Broughton,ST=Scottish Borders,C=GB

Chains

Dec 20, 2017

CN=SimpleHelp Ltd,O=SimpleHelp Ltd,L=Broughton,ST=Scottish Borders,C=GB

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:2f:4e:e1:52:d7

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 13, 2011 - Jan 28, 2028

Subject

Serial Number

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6d

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 17, 2006 - Jul 16, 2036

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Serial Number

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Serial Number

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 24, 2016 - Jun 24, 2027

Subject

CN=SimpleHelp Ltd,O=SimpleHelp Ltd,L=Broughton,ST=Scottish Borders,C=GB

Serial Number

02:da:67:2a:66:e8:20:15:7d:3e:a3:c0:2d:8e:dd:0d

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Revoked

Revocation Date

Nov 19, 2015

Timespan

Nov 19, 2015 - Jan 14, 2018

Minor OS version

Major OS version

Entry point

118080

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winmm

timeGetTime

wininet

InternetQueryOptionA InternetCloseHandle InternetOpenA HttpSendRequestA InternetErrorDlg HttpOpenRequestA InternetSetOptionA InternetReadFile InternetCrackUrlA InternetConnectA InternetOpenUrlA HttpQueryInfoA

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

winhttp

WinHttpGetIEProxyConfigForCurrentUser WinHttpCloseHandle WinHttpOpen WinHttpGetProxyForUrl

comctl32

InitCommonControlsEx

kernel32

GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA CreateFileA WriteConsoleW WriteConsoleA SetStdHandle HeapReAlloc GetLocaleInfoA RtlLookupFunctionEntry RtlVirtualUnwind GetCurrentProcessId GetTickCount QueryPerformanceCounter GetConsoleOutputCP CompareStringA MoveFileExA FreeLibrary Sleep GetProcAddress LoadLibraryA GetVersion WaitForSingleObject SetEvent TerminateThread CreateEventA GetLastError GetModuleHandleA CloseHandle CreateMutexA ReleaseMutex CreateThread SetCurrentDirectoryA CompareStringW GlobalFree DeleteFileA InitializeCriticalSection LeaveCriticalSection EnterCriticalSection DeleteCriticalSection GetExitCodeProcess CreateProcessA lstrlenA FormatMessageA GetShortPathNameA LocalAlloc GetVersionExA LocalFree GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA SetFilePointer HeapSize GetOEMCP GetACP GetCPInfo ReadFile FlushFileBuffers GetConsoleMode GetConsoleCP GetStartupInfoA GetFileType SetHandleCount FlsAlloc TlsSetValue SetLastError FlsFree TlsFree FlsSetValue GetCurrentDirectoryA HeapAlloc RaiseException HeapFree SetEndOfFile FileTimeToSystemTime FileTimeToLocalFileTime FindFirstFileA FindNextFileA FindClose MoveFileA ExitProcess GetCurrentProcess GetDateFormatA GetTimeFormatA GetDriveTypeA GetFullPathNameA GetTimeZoneInformation GetSystemTimeAsFileTime ExitThread GetCurrentThreadId MultiByteToWideChar WideCharToMultiByte SetEnvironmentVariableA GetFileAttributesA CreateDirectoryA RemoveDirectoryA GetCommandLineA GetProcessHeap HeapSetInformation HeapCreate WriteFile GetStdHandle GetModuleFileNameA RtlUnwindEx TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlCaptureContext FlsGetValue

user32

SetTimer GetWindowRect KillTimer SetWindowPos GetDesktopWindow DestroyWindow GetMessageA GetWindowLongPtrA PostThreadMessageA MonitorFromPoint LoadIconA SendMessageA GetMonitorInfoA TranslateMessage CreateWindowExA PeekMessageA DefWindowProcA GetCursorPos ShowWindow SetWindowLongPtrA DispatchMessageA SystemParametersInfoA LoadCursorA ValidateRect RegisterClassA

advapi32

GetUserNameA

Sharing

General

Malware Config

Signatures

File Explorer

Remote20Access-windows64-online.exe

PE Signature issue

winmm

wininet

version

winhttp

comctl32

kernel32

user32

advapi32

generic