MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5178316a133ee4ce629f5b31ddc2fdb8fd6ff8a581174c0a21f41d44ebfcd88d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemcosRAT

Vendor detections: 5

Intelligence 5 IOCs YARA 2 File information Comments

SHA256 hash:	5178316a133ee4ce629f5b31ddc2fdb8fd6ff8a581174c0a21f41d44ebfcd88d
SHA3-384 hash:	a9904c482eca31087b87d32c1d4122322340ed02b92c1f07438c0d94d37e5d1dc8bc9b1e71aa70187920be81d9b084d5
SHA1 hash:	5f42d401dbd70dec5dfdfe1609733bf875d0f9bf
MD5 hash:	2dbfc31d570c7db069024f30fd16af19
humanhash:	lake-sodium-carbon-solar
File name:	PO#08-17062020.scr
Download:	download sample
Signature	RemcosRAT Create hunting rule
File size:	1'315'840 bytes
First seen:	2020-06-17 18:21:27 UTC
Last seen:	2020-06-17 18:43:39 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	cc80a9340c5c455e95208d56a13a040a (3 x RemcosRAT, 1 x AveMariaRAT)
ssdeep	24576:E88RMlLc25p1sNakyTPouyefk4DJwPPhvAwo:EkFc2guyQbDJwXBA
Threatray	797 similar samples on MalwareBazaar
TLSH	0B555C21A2D19837C0231574DD26A368E829FF102939984E3FE57D885E3678DF82779F
Reporter	abuse_ch
Tags:	RAT RemcosRAT scr

abuse_ch

Malspam distributing RemcosRAT:

HELO: cloudhost-118159.nl-west-1.nxcli.net
Sending IP: 185.145.13.131
From: Maria <instituto@iaci.es>
Subject: PO#08-17062020
Attachment: PO08-17062020.IMG (contains "PO#08-17062020.scr")

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

Remcos

Link:

https://www.capesandbox.com/analysis/19556/

Detection(s):

PUA.Win.Packer.BorlandDelphi-15

Gathering data

Threat name:

Win32.Trojan.Wacatac

Status:

Malicious

First seen:

2020-06-17 18:36:17 UTC

AV detection:

23 of 29 (79.31%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=kf4dc2qth3sm4yu7lmy53qx5xd6w76ffqeluycrb6qouj2743cgq._file

Verdict:

malicious

Label(s):

remcos

RemcosRAT

4700822032416722d2dd61310e1dc4437092b80919b6a2c9c8680cf9fbc617a8

RemcosRAT

588a67a610dd3cc4803c3c54d4bbb0c197d542b69cc79bff6559b24e42f09107

RemcosRAT

738ea925d9f26dc03c18efd41de5e310285a36eef0147e7767a25dcf3fb1b24d

RemcosRAT

785790e2814af826f66cf31460fdcf7ce48513c6f451fca29fa52f101dd65b00

RemcosRAT

912dbbf9611cfd6d26072c85f44c3758c740a533ab01a76a82da92bcece73d1c

RemcosRAT

af1cf572150e95fd75306a13eb3d2306e1e1fb4ef6c238f53f30f2525389e07b

RemcosRAT

b362bb2946e02fd0ef8c7a7b186ac41ce12c2c71e798b0a31e16fbfd0c83d958

RemcosRAT

bf3b90cfb2a1fcabe1ce28afe3c00a31312e2ca097e9056e0470ab47bdcf22dc

RemcosRAT

c59842c19c1b3f0171b40eebfb3e98ddccc4237edcaaa62990a0881ee1f6f798

RemcosRAT

+ 787 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

1/10

Tags:

n/a

Link:

https://tria.ge/reports/200624-t64xb96eva/

Behaviour

Suspicious use of WriteProcessMemory

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_RemcosRAT Create hunting rule
Author:	abuse.ch

Rule name:	win_remcos_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator