MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 28a946eeb247e57497941133171fcf539e23980fa5fa1bedede5c59bac6e2a38. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemcosRAT

Vendor detections: 7

Intelligence 7 IOCs YARA 2 File information Comments

SHA256 hash:	28a946eeb247e57497941133171fcf539e23980fa5fa1bedede5c59bac6e2a38
SHA3-384 hash:	28b7cf709e40df302944a860fc743fc0ef14808da5c921b38a7a585938b95d332597a1dbcc1e7bc1fa5b75a03a012e8c
SHA1 hash:	55889298f17e1914feea698a300658dcb11dbce8
MD5 hash:	22d696630d96b74a784957368d2262fd
humanhash:	fourteen-quebec-march-massachusetts
File name:	DHL 8897209547 Documento di ricezione, pdf.exe
Download:	download sample
Signature	RemcosRAT Create hunting rule
File size:	329'728 bytes
First seen:	2020-06-25 09:04:24 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	6144:Q+w6PwvHFHS0YzAaqxCi0q7pWqmVEvynLdWgxq4g97G6+nFRAH9R:HPPwfFHEzAL0sQqyEuHCq6E8
Threatray	852 similar samples on MalwareBazaar
TLSH	4A64C018035C9F99D6BE8B79D0E5201583F89602714BFF699EC570ED3CA3BE2840B667
Reporter	abuse_ch
Tags:	DHL exe nVpn RAT RemcosRAT

abuse_ch

Malspam distributing RemcosRAT:

HELO: cloudhost-505135.us-midwest-1.nxcli.net
Sending IP: 209.87.159.221
From: DHL Express Cargo Italy <delivery@dhl.com>
Subject: Consegna merci DHL
Attachment: DHL 8897209547 Documento di ricezione, pdf.iso (contains "DHL 8897209547 Documento di ricezione, pdf.exe")

RemcosRAT C2:
egommbute2020.ddns.net:7171 (185.19.85.135)

Pointing to nVpn:

% Information related to '185.19.84.0 - 185.19.85.255'

% Abuse contact for '185.19.84.0 - 185.19.85.255' is 'abuse@datawire.ch'

inetnum: 185.19.84.0 - 185.19.85.255
netname: DATAWIRE-DATACENTERS
descr: CUSTOMERS ZG01
country: CH
admin-c: DA4314-RIPE
tech-c: DA4314-RIPE
status: ASSIGNED PA
mnt-by: DATAWIRE-NOC
created: 2013-09-23T14:18:55Z
last-modified: 2013-09-23T14:18:55Z
source: RIPE

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

Remcos

Link:

https://www.capesandbox.com/analysis/14074/

Detection(s):

SecuriteInfo.com.Generic.mg.181bf63f744587d9.5579.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a custom TCP request

Creating a window

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

Creating a file in the %temp% directory

Launching a process

Creating a process with a hidden window

Deleting a recently created file

Creating a file in the %AppData% subdirectories

Creating a file

Creating a process from a recently created file

Running batch commands

Unauthorized injection to a recently created process

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Enabling autorun with Startup directory

Detection:

remcos

Link:

https://mwdb.cert.pl/sample/28a946eeb247e57497941133171fcf539e23980fa5fa1bedede5c59bac6e2a38/

Gathering data

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=fcuun3vsi7sxjf4ucezroh6pkopchgapux5bx3pn4xczxldofi4a._file

Verdict:

malicious

Label(s):

remcos

RemcosRAT

667d35d2cff2979ca84df0afe1eca6c164e1d919b989e16b97166c7a30c77a87

RemcosRAT

6d6c5f16e0a786ca6fd218be24a98fe8ea46b6d73fa77a84e31b22717d81aad8

RemcosRAT

6fda20771e4364403f103048e8cae0d0b41a01b752511c1d67d633feee0059b0

RemcosRAT

738ea925d9f26dc03c18efd41de5e310285a36eef0147e7767a25dcf3fb1b24d

RemcosRAT

93c327b46d6354a91a9b20311a2f1e1873e132765816ec26443eb1971ccd2946

RemcosRAT

af1cf572150e95fd75306a13eb3d2306e1e1fb4ef6c238f53f30f2525389e07b

RemcosRAT

b8a03fd14b3a3695af8b6c781eb946214a98986279678c6b2a477f22ba1ac3cf

RemcosRAT

c0a656a2f73c254ed2f1e73630083849890b7c1e36161e89fe29d2fd014f9fff

RemcosRAT

f9441d3651d67748ec1a2fd325ea1aa9d914208c7fae0853e5b769e52e66ccb8

RemcosRAT

+ 842 additional samples on MalwareBazaar

Result

Malware family:

remcos

Score:

10/10

Tags:

rat family:remcos persistence

Link:

https://tria.ge/reports/200625-xyc7snn9ze/

Behaviour

Suspicious use of SetWindowsHookEx

Creates scheduled task(s)

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Adds Run entry to start application

Loads dropped DLL

Executes dropped EXE

Remcos

Malware Config

C2 Extraction:

egommbute2020.ddns.net:7171

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_RemcosRAT Create hunting rule
Author:	abuse.ch

Rule name:	win_remcos_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator