MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 28d692bdce30404b89c0d2c4758ee6f7f16a397ef51d0ddae4b3e2e4c1de4c0b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 28d692bdce30404b89c0d2c4758ee6f7f16a397ef51d0ddae4b3e2e4c1de4c0b
SHA3-384 hash: 58c4b1ab824f4ec902af82526dec17ef6e9939082b6e72fd7ae0085cfb64c3003612fc9b299dd0ccca33f1de5fb1ddc4
SHA1 hash: e1d9ad1e0019d716ea5ef003880945bb356d24f0
MD5 hash: 140b3165b07ed84360228163ca7c13f2
humanhash: ceiling-quebec-twenty-arkansas
File name:5d7092a0e791a8208b7d2d72e0d0c12f.exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:126'976 bytes
First seen:2020-03-26 16:27:58 UTC
Last seen:2020-04-01 14:35:09 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 5f0c90c109d16124e83cb7a25caef54f (28 x RemcosRAT, 1 x FormBook, 1 x NetWire)
ssdeep 3072:mVh1qaSs6IF9OK4b80S2Van4Va1cpcQjed5OzqhUXa:yh1qn3IF9Obbj/a1cpcQjeHOzqhUX
Threatray 756 similar samples on MalwareBazaar
TLSH A3C3E967F20B80A3D863027156507B72EEBCBC321A5D5157E7E4D8811DF588E902AAFF
Reporter abuse_ch
Tags:exe GuLoader RemcosRAT


Avatar
abuse_ch
Payload dropped by GuLoader from the following URL:
https://drive.google.com/uc?export=download&id=1x7h0eVnurp-FeOIEl3w3euC7Ns87ssSb

Intelligence

File Origin
# of uploads :
2
# of downloads :
86
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.Rescoms-6598304-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Rescoms
Create hunting rule
Status:
Malicious
First seen:
2020-03-24 01:59:00 UTC
File Type:
PE (Exe)
Extracted files:
2
AV detection:
30 of 31 (96.77%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fdljfpoogbaexcoa2lchldxg67ywuol66uoq3wxewprojqo6jqfq._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
11a7d2f2722df45e01851eb75765dbcb21f70ea9c8f89f58b9e8ccacda92cc83
RemcosRAT
28a946eeb247e57497941133171fcf539e23980fa5fa1bedede5c59bac6e2a38
RemcosRAT
3faaf4c39ac62ca025232a6482aaf902472af9e56d5be60e1e7478c29d30e71c
RemcosRAT
4c5c201ddc74537db5e203d39f745acb5fd28c5fc1a8087c99226f2dc56a9e99
RemcosRAT
64799c25e25bdce140bc8e9731a748efb0308b6e6d700b7f8d35617f5db0807b
RemcosRAT
67f5353bdabe4d52ecb054b0ef0bd7faa2bc647843b56d3fab36e749b98a1e09
RemcosRAT
83413a3a3f07ee931dbfecaefed51d0b01d2b13b85920bdd485f0b2ce41acba5
RemcosRAT
8987392b8f6dec69aed20d93f0662b879483c2b8bfab22e3affc4bf909464b9d
RemcosRAT
99288949625f49d5fce4c52083d100a232b1fbec563aefa39843f564cc71190b
RemcosRAT
deb388c337ef9b156546db5c9c7cc3c08aea24ab159fb71d474e8b40d703f5ef
RemcosRAT
+ 746 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

8f9d5922e9858dc9ccde065efb0b1668833d20b262438b43e81b3febe41462c6

RemcosRAT

Executable exe 28d692bdce30404b89c0d2c4758ee6f7f16a397ef51d0ddae4b3e2e4c1de4c0b

(this sample)

  
Dropped by
MD5 5d7092a0e791a8208b7d2d72e0d0c12f
  
Dropped by
MD5 ddf991887033a2a5039d36e26f1830a6
  
Dropped by
GuLoader
  
Dropped by
SHA256 8f9d5922e9858dc9ccde065efb0b1668833d20b262438b43e81b3febe41462c6
  
Dropped by
SHA256 68f560e81f9ad986fc650d013f6adaa47aa702cfdf46ea1c0d982a2e8c0dcf86
  
URLhaus
https://urlhaus.abuse.ch/url/326432/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
GDI_PLUS_APIInterfaces with Graphicsgdiplus.dll::GdiplusStartup
gdiplus.dll::GdipGetImageEncoders
gdiplus.dll::GdipGetImageEncodersSize
gdiplus.dll::GdipAlloc
MULTIMEDIA_APICan Play MultimediaWINMM.dll::mciSendStringA
WINMM.dll::mciSendStringW
WINMM.dll::PlaySoundW
WINMM.dll::waveInAddBuffer
WINMM.dll::waveInClose
WINMM.dll::waveInOpen
SECURITY_BASE_APIUses Security Base APIADVAPI32.dll::AdjustTokenPrivileges
SHELL_APIManipulates System ShellSHELL32.dll::ShellExecuteExA
SHELL32.dll::ShellExecuteW
URL_MONIKERS_APICan Download & Execute componentsurlmon.dll::URLDownloadToFileW
urlmon.dll::URLOpenBlockingStreamW
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CreateProcessW
KERNEL32.dll::CreateProcessA
KERNEL32.dll::OpenProcess
ADVAPI32.dll::OpenProcessToken
KERNEL32.dll::VirtualAllocEx
KERNEL32.dll::WriteProcessMemory
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::LoadLibraryA
KERNEL32.dll::GetDriveTypeA
KERNEL32.dll::GetStartupInfoA
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::AllocConsole
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CopyFileW
KERNEL32.dll::CreateDirectoryW
KERNEL32.dll::CreateFileMappingA
KERNEL32.dll::CreateFileW
KERNEL32.dll::DeleteFileA
KERNEL32.dll::DeleteFileW
WIN_BASE_USER_APIRetrieves Account InformationADVAPI32.dll::GetUserNameW
ADVAPI32.dll::LookupPrivilegeValueA
WIN_REG_APICan Manipulate Windows RegistryADVAPI32.dll::RegCreateKeyA
ADVAPI32.dll::RegCreateKeyW
ADVAPI32.dll::RegCreateKeyExW
ADVAPI32.dll::RegDeleteKeyA
ADVAPI32.dll::RegOpenKeyExA
ADVAPI32.dll::RegOpenKeyExW
WIN_SVC_APICan Manipulate Windows ServicesADVAPI32.dll::ChangeServiceConfigW
ADVAPI32.dll::ControlService
ADVAPI32.dll::OpenSCManagerW
ADVAPI32.dll::OpenSCManagerA
ADVAPI32.dll::OpenServiceW
ADVAPI32.dll::QueryServiceConfigW
WIN_USER_APIPerforms GUI ActionsUSER32.dll::AppendMenuA
USER32.dll::EmptyClipboard
USER32.dll::OpenClipboard
USER32.dll::CreateWindowExA

Comments