MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9c76803cb5acd81ad611eed2bc4daa50f1a4e27cd2cea75e40f0d5011047e2a9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 4


Intelligence 4 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9c76803cb5acd81ad611eed2bc4daa50f1a4e27cd2cea75e40f0d5011047e2a9
SHA3-384 hash: 9744ed8701abd0e227007a8bf6f9b2d5f4baaa84a3ef350d2c00b08abf4e427bb1dfef63a93cfd975a9ec22a08bbb43c
SHA1 hash: 9c87e9ec996b656ffd828df91458645459559565
MD5 hash: 6c7b002d23f38600926eba53eb0126cf
humanhash: mississippi-virginia-cup-leopard
File name:file.scr
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:644'096 bytes
First seen:2020-05-28 06:46:14 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 14a86d600c59a07735f44434c52b41af (10 x AgentTesla, 2 x Loki, 2 x RemcosRAT)
ssdeep 12288:Zg8jof+rMCiLTwP+I3cUylgEe5tyZEA83GdaG51+z8hqDXtwkT3:jE+r6QP+I3IgEgGEX2t161t3
Threatray 842 similar samples on MalwareBazaar
TLSH F0D48E22E2AC4733C1E3163D9C1F7778992BBD5129286A462BE7DD4CDE397C13826187
Reporter abuse_ch
Tags:RAT RemcosRAT scr


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: mail.mowindra.ml
Sending IP: 173.82.238.253
From: CEF-TPE / Vivian Chen <admin@mowindra.ml>
Subject: S/ 翰聯 SHA TO CHICAGO LCL 提單草稿 ETD: 5/30 / BT2005030
Attachment: file.zip (contains "file.scr")

RemcosRAT C2:
188.72.124.143:2858

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.Artemis3956A314271F.14689.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-28 04:28:09 UTC
File Type:
PE (Exe)
Extracted files:
293
AV detection:
27 of 31 (87.10%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
0b8d469babc7b057403a1d7ca0f781c9a675523941cfcc8bb6eae582680746c4
RemcosRAT
2ddbe8b9f04a4a672878c6b54b8a3440d2f7d89b2fe0c5949df21c997c5443f7
RemcosRAT
4692d4716a224f54c928808d2d7ee7e9eaeb8531f1cd29b91886fa511a12f07a
RemcosRAT
59b1b0e770b3b964f7ad3290b9ebfa845b828c7819cf8282b2b7aa89530cff78
RemcosRAT
6307b6ffc48a88aeeff567c7a296ca6daf830f9b4eecf9f48352c489e5256fca
RemcosRAT
936aa436f6a85762fe0fa8f9f14af43e5a53ba7bf398f279925f73dc511c09b4
RemcosRAT
a7d93e9c9bb80f0f8a271ae4a101f305bac535e197697b35f291794fa83ef538
RemcosRAT
ac120fadb0fde46db30df42a52a0b65d34fa6621fa13f18c11b5fe93626dcf6d
RemcosRAT
b2f999593d2004d1ea8797e0d1a20096b204e5211d1b39b5e4998e7835555e41
RemcosRAT
f89c8debd5a5759bd372622cf7be54424d5e87c8b8246fb44835ea94d1f72bad
RemcosRAT
+ 832 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos evasion persistence rat trojan
Link:
https://tria.ge/reports/201109-bj38kmvf92/
Behaviour
Modifies registry key
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Modifies registry class
Suspicious use of SetThreadContext
Adds Run key to start application
Loads dropped DLL
Executes dropped EXE
Remcos
UAC bypass
Malware Config
C2 Extraction:
188.72.124.143:2858
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_RemcosRAT
Create hunting rule
Author:abuse.ch
Rule name:win_remcos_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip a22717d866d79bb6f31111ca550020b66f1d2f8d0fbc15696ced0e18ae4e64ad

RemcosRAT

Executable exe 9c76803cb5acd81ad611eed2bc4daa50f1a4e27cd2cea75e40f0d5011047e2a9

(this sample)

  
Dropped by
MD5 414e7c5cd8ca0a683bd43c2717bfccf3
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 a22717d866d79bb6f31111ca550020b66f1d2f8d0fbc15696ced0e18ae4e64ad

Comments