MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 785790e2814af826f66cf31460fdcf7ce48513c6f451fca29fa52f101dd65b00. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 5


Intelligence 5 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 785790e2814af826f66cf31460fdcf7ce48513c6f451fca29fa52f101dd65b00
SHA3-384 hash: a1437bc85b6842238ba4a2c9e70b81522af4a43d159f75a0a273de2f31396c22a725ab8e3326702030a529dcc17d3e77
SHA1 hash: 40e53f015aeef9e49425fc0026da4bc4c1d1a35b
MD5 hash: 853756beecdc9504fc99da29e7090a64
humanhash: fix-georgia-freddie-muppet
File name:RFQ-4591.scr
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'490'432 bytes
First seen:2020-06-19 06:04:09 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash e25804e2476796e2e14492adb0d1133c (7 x FormBook, 1 x NetWire, 1 x RemcosRAT)
ssdeep 24576:gsE+vF8Th7G6rdhASVNe1/hqIiH2ATM7x:gsEmIQSjiBiW
Threatray 821 similar samples on MalwareBazaar
TLSH C5658D37A3D17476C1E63EB9D816C69E58DEBDC01A94107F1AEB4B0B1A2B661333C172
Reporter abuse_ch
Tags:RAT RemcosRAT scr


Avatar
abuse_ch
RemcosRAT C2:
206.123.129.103:4565

Intelligence

File Origin
# of uploads :
1
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Remcos
Create hunting rule
Link:
https://www.capesandbox.com/analysis/9460/
Detection(s):
PUA.Win.Packer.BorlandDelphi-15
Create hunting rule

PUA.Win.Adware.Webalta-6854075-0
Create hunting rule

PUA.Win.Adware.Webalta-6862190-0
Create hunting rule

SecuriteInfo.com.Trojan.DownLoader33.54874.8500.28600.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Exploit.BypassUac
Create hunting rule
Status:
Malicious
First seen:
2020-06-19 06:06:06 UTC
AV detection:
27 of 31 (87.10%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=pblzbyubjl4cn5tm6mkgb7opptsike6g6ri7ziu7uuxrahowlmaa._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
23808af89fdb7af9f2b747f6a339122177e7abc79136a411f24831cf329606b2
RemcosRAT
5178316a133ee4ce629f5b31ddc2fdb8fd6ff8a581174c0a21f41d44ebfcd88d
RemcosRAT
6ecd0fd68547a4d37029ffff903e0fb2698b98c8774aaa9b2593b4f4936cd812
RemcosRAT
70dea2916d0ca9c6cbd5414addb05007b7ece30a36129de2733cd5373710ee99
RemcosRAT
7246bf76c555a29cb79c124fb1e17001ffcd4625e99fdd552ff9fe88427a0e48
RemcosRAT
7c7a7c3e89daeb57bcd8fe5a895461161efafa3a5b2f111e0e23aff6b3f9535a
RemcosRAT
91864b23c3bfb54a354704f3fa769b25d641fd510aa4854a45f5de5956505e91
RemcosRAT
af1cf572150e95fd75306a13eb3d2306e1e1fb4ef6c238f53f30f2525389e07b
RemcosRAT
b4cc964b3b1f415fccc67c3a67bd73c6841a6438c4e0725fe8b44602ebece89b
RemcosRAT
c24fa17848ef43bb56832a37269703dc8ee023e71ad2c3ff95a421288a63f20c
RemcosRAT
+ 811 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/200624-y6tgw44wfs/
Behaviour
Suspicious use of WriteProcessMemory
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_RemcosRAT
Create hunting rule
Author:abuse.ch
Rule name:win_remcos_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

Executable exe 785790e2814af826f66cf31460fdcf7ce48513c6f451fca29fa52f101dd65b00

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/9460/

Comments