MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 588a67a610dd3cc4803c3c54d4bbb0c197d542b69cc79bff6559b24e42f09107. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemcosRAT

Vendor detections: 4

Intelligence 4 IOCs YARA 2 File information Comments

SHA256 hash:	588a67a610dd3cc4803c3c54d4bbb0c197d542b69cc79bff6559b24e42f09107
SHA3-384 hash:	4a3b220908cddfb0f14c922e7393e01d3a1c1e363055afb2f47cd6f5c9803298e329ded942aaccfee587df1ccb729bdd
SHA1 hash:	c9ff13a53bda5acc362b51804f23b8b5a1f867dc
MD5 hash:	b2d802b81a9758a2bdceb77a87ed2184
humanhash:	chicken-skylark-michigan-two
File name:	DOC_UY76KJ90-00.exe
Download:	download sample
Signature	RemcosRAT Create hunting rule
File size:	1'315'840 bytes
First seen:	2020-06-17 18:31:47 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	cc80a9340c5c455e95208d56a13a040a (3 x RemcosRAT, 1 x AveMariaRAT)
ssdeep	24576:t88RMlLc25p1sNakyTPouyefk4DJwPPhvEwo:tkFc2guyQbDJwXBE
Threatray	790 similar samples on MalwareBazaar
TLSH	0E555C21A2D19837C0231574DD26A368E829FF102939984E3FE57D885E3678DF82779F
Reporter	abuse_ch
Tags:	exe nVpn RAT RemcosRAT

abuse_ch

Malspam distributing RemcosRAT:

HELO: vps.goindustry.ml
Sending IP: 23.254.230.163
From: Stephen Rice <info@goindustry.ml>
Subject: Re: Order Enquiry
Attachment: DOC_UY76KJ90-00.rar (contains "DOC_UY76KJ90-00.exe")

RemcosRAT C2:
79.134.225.78:6666

Hosted on nVpn:

% Information related to '79.134.225.64 - 79.134.225.127'

% Abuse contact for '79.134.225.64 - 79.134.225.127' is 'abuse@your-vpn.network'

inetnum: 79.134.225.64 - 79.134.225.127
netname: YOUR_VPN_NETWORK
country: DE
remarks: ****************************************************
remarks: This subnet belongs to a VPN service provider.
remarks: We protect the right to privacy, which means
remarks: we don't log the activities of our users.
remarks: ****************************************************
admin-c: EH4074-RIPE
tech-c: YVN10-RIPE
status: ASSIGNED PA
abuse-c: YVN10-RIPE
org: ORG-YVN1-RIPE
mnt-by: AF15-MNT
created: 2019-07-19T18:26:38Z
last-modified: 2019-07-19T18:51:28Z
source: RIPE

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Gathering data

Detection(s):

PUA.Win.Packer.BorlandDelphi-15

Gathering data

Threat name:

Win32.Trojan.Wacatac

Status:

Malicious

First seen:

2020-06-17 21:34:48 UTC

AV detection:

24 of 31 (77.42%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=lcfgpjqq3u6mjab4hrknjo5qygl5kqvwttdzx73flgze4qxqsedq._file

Verdict:

malicious

Label(s):

remcos

RemcosRAT

39b6534e71eea7f25cd242cbeec0e465b211f8cd453172f284feac37ae8c973d

RemcosRAT

4700822032416722d2dd61310e1dc4437092b80919b6a2c9c8680cf9fbc617a8

RemcosRAT

5cd183da8ceb32dfce5219ece25684d9eb1624ca8e0ec30e374219732944c8e5

RemcosRAT

738ea925d9f26dc03c18efd41de5e310285a36eef0147e7767a25dcf3fb1b24d

RemcosRAT

912dbbf9611cfd6d26072c85f44c3758c740a533ab01a76a82da92bcece73d1c

RemcosRAT

af1cf572150e95fd75306a13eb3d2306e1e1fb4ef6c238f53f30f2525389e07b

RemcosRAT

b362bb2946e02fd0ef8c7a7b186ac41ce12c2c71e798b0a31e16fbfd0c83d958

RemcosRAT

e1b4622454cead31c14bd55cf1985eb6b5e93483989b183cf32e79e07ee4dc13

RemcosRAT

f89c8debd5a5759bd372622cf7be54424d5e87c8b8246fb44835ea94d1f72bad

RemcosRAT

+ 780 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

1/10

Tags:

n/a

Link:

https://tria.ge/reports/200624-mfyzc586ms/

Behaviour

Suspicious use of WriteProcessMemory

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_RemcosRAT Create hunting rule
Author:	abuse.ch

Rule name:	win_remcos_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator