MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3b0f6129ac1124a021197f9fbbd0edd587fd763f622f47020eed504ba0e36805. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemcosRAT

Vendor detections: 5

Intelligence 5 IOCs YARA 2 File information Comments

SHA256 hash:	3b0f6129ac1124a021197f9fbbd0edd587fd763f622f47020eed504ba0e36805
SHA3-384 hash:	c886d218c73a227e1acde5ace51fe9b9f4fceb4999a9af5e7d43a0ea1f94011362d507828fbd64aebcea6aba0cdd8608
SHA1 hash:	10cca04ac93f7ffa3bd8e1ce34015ddd04d1ce14
MD5 hash:	293afaf18d7832ee82f047c96946fb26
humanhash:	finch-minnesota-eight-summer
File name:	YAMAHA PI20200206AP,pdf.exe
Download:	download sample
Signature	RemcosRAT Create hunting rule
File size:	621'568 bytes
First seen:	2020-06-23 20:13:43 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	37ec15e12a6a58142524cbf63ac13fd6 (6 x RemcosRAT, 2 x FormBook, 1 x NetWire)
ssdeep	12288:5ARldIm597ql0ynjNHEJRXZdL38YN2hp7qWWWy/z:qXHql9njNHE5Z3PN2Dy/z
Threatray	938 similar samples on MalwareBazaar
TLSH	2AD4AF33F2C08877C57E29B9AD0F45E5951ABE757E18688A3BCC1E4C4FB92913C29193
Reporter	abuse_ch
Tags:	exe RAT RemcosRAT

abuse_ch

Malspam distributing RemcosRAT:

HELO: server2-ip18.mailsentinel.net
Sending IP: 111.90.139.82
From: Yamaha Corporation <atcliente.yamaha@maygap.com>
Subject: RE: PI20200206AP
Attachment: YAMAHA PI20200206AP,pdf.iso (contains "YAMAHA PI20200206AP,pdf.exe")

RemcosRAT C2:
goddywin.freedynamicdns.net

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

Remcos

Link:

https://www.capesandbox.com/analysis/13278/

Detection(s):

PUA.Win.Adware.Slugin-6803969-0

PUA.Win.Adware.Slugin-6840354-0

SecuriteInfo.com.AI.Packer.AEC3198E21.9706.UNOFFICIAL

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/3b0f6129ac1124a021197f9fbbd0edd587fd763f622f47020eed504ba0e36805/

Threat name:

Win32.Trojan.Remcosrat

Status:

Malicious

First seen:

2020-06-23 20:15:07 UTC

AV detection:

25 of 31 (80.65%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=hmhwcknmceskaiizp6p3xuhn2wd725r7mixuoaqo5viexihdnacq._file

Verdict:

malicious

Label(s):

remcos

RemcosRAT

575c275cfe07d8be90d21a93cc1f651ceaa60b230e771c8c853d8370a221fe77

RemcosRAT

588a67a610dd3cc4803c3c54d4bbb0c197d542b69cc79bff6559b24e42f09107

RemcosRAT

5c9667b60610ff2eeb6b26096b7ac951ed3d59fc716a6b8aa1c94c38658b0db7

RemcosRAT

8599ded7ef4b89944c5a5330e8608d9e1ab28acd67706284b617ddca1a7d74ab

RemcosRAT

a5f2366c498c4f33ec95d923ceef75d73855181b8bf3c2d28ac1407eadf1bbd1

RemcosRAT

af1cf572150e95fd75306a13eb3d2306e1e1fb4ef6c238f53f30f2525389e07b

RemcosRAT

b2f999593d2004d1ea8797e0d1a20096b204e5211d1b39b5e4998e7835555e41

RemcosRAT

c59842c19c1b3f0171b40eebfb3e98ddccc4237edcaaa62990a0881ee1f6f798

RemcosRAT

d507ed9c29f7392e025b68e345b59961c392826aaf41a3992dbab7aff0253e6a

RemcosRAT

+ 928 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

6/10

Tags:

n/a

Link:

https://tria.ge/reports/200624-pnge8cx126/

Behaviour

Suspicious use of WriteProcessMemory

Legitimate hosting services abused for malware hosting/C2

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_RemcosRAT Create hunting rule
Author:	abuse.ch

Rule name:	win_remcos_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator