MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 510c93a2393e7ac30f4be84920ac3875685c95f75648ceb0c2a6f27b32d84b9a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemcosRAT

Vendor detections: 4

Intelligence 4 IOCs YARA 2 File information Comments

SHA256 hash:	510c93a2393e7ac30f4be84920ac3875685c95f75648ceb0c2a6f27b32d84b9a
SHA3-384 hash:	0d51774b3e2f45f61c8db3cac8a1a1b6a6fe23837cbd1781b8e9df311088168f5eb403c1873399972071d05592b33772
SHA1 hash:	07529e61a996a49fdb44f7aca27cca440aa02ab2
MD5 hash:	5465c3f4669b14fc127103979f9f959d
humanhash:	spring-ceiling-early-summer
File name:	NEW_PO-Byron_Distributors.exe
Download:	download sample
Signature	RemcosRAT Create hunting rule
File size:	218'624 bytes
First seen:	2020-05-13 06:26:20 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	6144:yYz4Cg3z8et1vWlqZ1dDUJGHnDFdAJG6QaBp9SFc+1Fn:yCodNZ5nDfAJG6QYpUrLn
Threatray	1'780 similar samples on MalwareBazaar
TLSH	7324F12E357D2A1FC76808F490D131485BF8C1596A82F7C8DED1E0E6D977BC48A3299B
Reporter	abuse_ch
Tags:	exe RAT RemcosRAT Yahoo

abuse_ch

Malspam distributing RemcosRAT:

HELO: sonic313-54.consmr.mail.sg3.yahoo.com
Sending IP: 106.10.240.113
From: Paul Byron <marketing@pristinetech.in>
Reply-To: marketing@pristinetech.in
Subject: PO-001 ( Byron Distributors Ltd )
Attachment: NEW_PO-Byron_Distributors.rar (contains "NEW_PO-Byron_Distributors.exe")

RemcosRAT C2:
www.valjan.in:7331 (185.19.85.183)

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL

Gathering data

Threat name:

ByteCode-MSIL.Trojan.Kryptik

Status:

Malicious

First seen:

2020-05-13 06:36:57 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

26 of 31 (83.87%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=kegjhirzhz5mgd2l5besblbyovufzfpxkzem5mgcu3zhwmwyjona._file

Verdict:

unknown

RemcosRAT

1a7e38319cb2a9a43f874fc3a6b2f4afcacc84386284982c61b2effaa318fd1d

RemcosRAT

2b969d8cdb8ebab56e42e08200126ecf287e3ce31245f7fb8563245cc53615de

RemcosRAT

3497f186cb8e8ee119f82a97445bb6a6d75a73d480a57c12a864fcb7e8b3b725

RemcosRAT

4be43e080b60c1fe0c24ff6b13a48baa58e0c521a75f6586a80dee1814a04ae7

RemcosRAT

79707deb89afd6a88eaf63af7065b7e30d0508126cf6c8664d01a924dd60e4a5

RemcosRAT

9950693e7a2ed5a37008ea3a7c2a185132af4f3fedfbbba41fb03939dadb8044

RemcosRAT

ba6c27eedbe9c1152f8232f685600ec69ad11ada7b6e82db997e08d89a1b0385

RemcosRAT

eed00acb5b2bd676ab5ae74611ed880e6ef40d855d401ce9a938d5700f2b1de1

RemcosRAT

f29c7a735adfcc42de35a17646ead9eaf23ae1a0cc99ad468b720d0e3be7dad6

RemcosRAT

+ 1'770 additional samples on MalwareBazaar

Result

Malware family:

remcos

Score:

10/10

Tags:

family:remcos rat

Link:

https://tria.ge/reports/201109-b1kfdlkcaj/

Behaviour

Creates scheduled task(s)

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Uses the VBS compiler for execution

Remcos

Malware Config

C2 Extraction:

www.valjan.in:7331

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_RemcosRAT Create hunting rule
Author:	abuse.ch

Rule name:	win_remcos_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator