MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3da5830536d5610225441bfb5ff114a62ad2b52617c5299b6d5a78c40f21b2a9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3da5830536d5610225441bfb5ff114a62ad2b52617c5299b6d5a78c40f21b2a9
SHA3-384 hash: 9b4577ed7ab21d62e0dc70c6fcec76868c3c69bacc57bc5c38b0c06defba5a9a18b726941fe2d23c683eb415f82bff3b
SHA1 hash: 4093b128719cb557fba53ea5e1b30a13054c7fd8
MD5 hash: 7027409cdeb8fc9a7974709acd9345b5
humanhash: north-nitrogen-asparagus-sad
File name:bank confirmation details,rar.exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:704'000 bytes
First seen:2020-07-20 08:53:53 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'461 x Formbook, 12'202 x SnakeKeylogger)
ssdeep 12288:FubAVL1q9I6/kldSCGDyaod+ik4g8y3SoDaWeyFQ8:FuILOPW2rEloDZ+8
Threatray 897 similar samples on MalwareBazaar
TLSH 61E4BDC9AA905400C9AD2FB55E32CE7403327D09F5F1A70E2BC9BD6B3A7B792D414762
Reporter abuse_ch
Tags:exe nVpn RAT RemcosRAT


Avatar
abuse_ch
Malspam distributing unidentified malware:

From: Yoga company <yoga1985@yoga.com.tw>
Subject: bank details
Attachment: bank confirmation details,rar.rar (contains "bank confirmation details,rar.exe")

Unknown RAT C2:
newlogs.ddns.net:1234 (194.5.98.9)

Pointing to nVpn:

% Information related to '194.5.98.0 - 194.5.98.255'

% Abuse contact for '194.5.98.0 - 194.5.98.255' is 'abuse@privacyfirst.sh'

inetnum: 194.5.98.0 - 194.5.98.255
remarks: This prefix is assigned to The PRIVACYFIRST Project, which
remarks: operates infrastructure jointly used by various VPN service
remarks: providers. We have a very strong focus on privacy and freedom.
remarks: In case of abuse, we encourage all international law enforcement
remarks: agencies to get in touch with our abuse contact. Due to the fact
remarks: that we keep no logs of user activities and only share data when
remarks: it is legally required under our jurisdiction, it is very unlikely
remarks: for a demand of user information to be successful. Still, that
remarks: should not deter you from reaching out.
netname: PRIVACYFIRST-NOR
country: NO
descr: Sandefjord
admin-c: TPP15-RIPE
tech-c: TPP15-RIPE
org: ORG-TPP6-RIPE
status: ASSIGNED PA
mnt-by: PRIVACYFIRST-MNT
created: 2019-04-26T16:42:54Z
last-modified: 2020-07-14T18:04:10Z
source: RIPE

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Remcos
Create hunting rule
Link:
https://www.capesandbox.com/analysis/28832/
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/391114
Behaviour
Behavior Graph:
Download SVG
Detection:
remcos
Create hunting rule
Link:
https://mwdb.cert.pl/sample/3da5830536d5610225441bfb5ff114a62ad2b52617c5299b6d5a78c40f21b2a9/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-20 04:10:31 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hwsygbjw2vqqejkedp5v74iuuyvnfnjgc7cstg3nlj4midzbwkuq._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
13eaaf168207a5014c105532b6a23805fc6db28f73908914a4583979173cc254
RemcosRAT
2f07a5d8c1e6ac465e5d306b0fb8335aa41f3204b9bf9793337a849a93921a9a
RemcosRAT
314d26bc5fe146f5040c40b8c5b889e6e90cb0b22ec694564c1182d49c3bf950
RemcosRAT
397545efcbf53bebabdb003bbe9f8b619b7ffdd5383c21ecd9e99c6de3e3cd83
RemcosRAT
3bdfaf82d5d56f2546be44b3355f8d72cc0508984586e0fba3d704a5adabf7d1
RemcosRAT
64ba0f4265f9ed3f3f9315ee0256b360827074d5f898a7eb07ed98dd5f7fec7e
RemcosRAT
970ffc480d61b37737f34ddf738e257a99162cce8338f7c59fdd4ab995ae9dfc
RemcosRAT
b3ae13e392ebe3eec95949395786577344472af7588ed1db4577c597a417e8a4
RemcosRAT
c8c1e04edd5c422d065e27a3a73931d373de200419cd9ba649fdfadee686e5f2
RemcosRAT
d69aa1932b2e702e5065ee19da9fc9cf2b05e7dbaa617141b14eaa501a14955e
RemcosRAT
+ 887 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
rat family:remcos
Link:
https://tria.ge/reports/200720-vfj4yl5yx2/
Behaviour
Suspicious use of WriteProcessMemory
Creates scheduled task(s)
Suspicious use of SetThreadContext
Uses the VBS compiler for execution
Remcos
Malware Config
C2 Extraction:
newlogs.ddns.net:1234
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3da5830536d5610225441bfb5ff114a62ad2b52617c5299b6d5a78c40f21b2a9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

rar d8a3e6fe86b22101b8db1686acffa179db95361541f747108443043dae15e2fc

RemcosRAT

Executable exe 3da5830536d5610225441bfb5ff114a62ad2b52617c5299b6d5a78c40f21b2a9

(this sample)

  
Dropped by
MD5 07ce847af4843fd192fb51a9697799b8
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/28832/
  
Dropped by
SHA256 d8a3e6fe86b22101b8db1686acffa179db95361541f747108443043dae15e2fc

Comments