MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ce9eea7daa40294ea32ee596e1a88ec5e6301ed44e08420ec9ab6bb5d810846a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemcosRAT

Vendor detections: 5

Intelligence 5 IOCs YARA 3 File information Comments

SHA256 hash:	ce9eea7daa40294ea32ee596e1a88ec5e6301ed44e08420ec9ab6bb5d810846a
SHA3-384 hash:	eb590fcd36bb992af5bbcdb70560eb4d95116673011ed0217facd7b72f92de6470bc677935c1fa1cfcfbce53d611881a
SHA1 hash:	60f2b6021ad0c2ca7b10d9a5c48e91cddd3a0c8c
MD5 hash:	18696c1965f4976fc8196516f75fdf63
humanhash:	florida-yankee-black-nevada
File name:	fkfiif.com
Download:	download sample
Signature	RemcosRAT Create hunting rule
File size:	321'536 bytes
First seen:	2020-06-10 11:39:22 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	6144:XGd7v1I4xCt+Eg38+B845tlxaAb+M24L823Pe47GxwExBs9EDAJsU24qo1UJTT7I:Wtv1LCv68+645bxaAbb1Q2fP7GxhxW+a
Threatray	6'031 similar samples on MalwareBazaar
TLSH	D7646C893250B6DFC86BC8B2C9A92C20AB6074B7531BD347A45716ED990D7DBCF046E3
Reporter	abuse_ch
Tags:	com nVpn RAT RemcosRAT

abuse_ch

Malspam distributing RemcosRAT:

HELO: smtp2.hiworks.co.kr
Sending IP: 121.254.168.210
From: Barmon Ashik <bashik_sm@wontradingbd.com>
Reply-To: "Barmon Ashik" <bashik_sm@wontradingbd.com>
Subject: RE: CANADA ORDER
Attachment: fkfiif.r25 (contains "fkfiif.com")

RemcosRAT C2:
91.193.75.178:8769

Hosted on nVpn:

% Information related to '91.193.75.0 - 91.193.75.255'

% Abuse contact for '91.193.75.0 - 91.193.75.255' is 'abuse@kgb-vpn.org'

inetnum: 91.193.75.0 - 91.193.75.255
netname: NON-LOGGING-VPN-SERVICE
descr: Please note that we don't store any user data.
descr: Our main effort is not to make money, but to preserve values like the
descr: freedom of expression, the freedom of press, the right to data protection
descr: and informational self-determination.
descr: We ask all employees of Spamhaus and all self-proclaimed deputy sheriffs
descr: to stop your attacks against us.
country: EU
admin-c: KA7109-RIPE
tech-c: KA7109-RIPE
org: ORG-KHd1-RIPE
status: ASSIGNED PI
mnt-by: RIPE-NCC-END-MNT
mnt-by: KGB-MNT
mnt-routes: KGB-MNT
sponsoring-org: ORG-MW1-RIPE
created: 2012-06-04T11:05:55Z
last-modified: 2019-12-05T05:39:00Z
source: RIPE

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Gathering data

Threat name:

ByteCode-MSIL.Spyware.FormBook

Status:

Malicious

First seen:

2020-06-10 11:41:05 UTC

AV detection:

25 of 31 (80.65%)

Threat level:

2/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=z2pou7nkiauu5izo4wlodkeoyxtdahwujyeeedwjvnv3lwaqqrva._file

Verdict:

malicious

Label(s):

remcos

RemcosRAT

18aae95253ffa453609ef3e1150cf9c2b167a1b1c59ae1270e279f8d5e070c27

RemcosRAT

3b13ea61e91a0312f8c187096e435168cee2d2277c46373d01899497345bd0e9

RemcosRAT

667d35d2cff2979ca84df0afe1eca6c164e1d919b989e16b97166c7a30c77a87

RemcosRAT

7d6b63c5a80035e7823a17dc7493048dbf0bdd33110ae9df169a3bcee02527b9

RemcosRAT

93c327b46d6354a91a9b20311a2f1e1873e132765816ec26443eb1971ccd2946

RemcosRAT

ac120fadb0fde46db30df42a52a0b65d34fa6621fa13f18c11b5fe93626dcf6d

RemcosRAT

b8a03fd14b3a3695af8b6c781eb946214a98986279678c6b2a477f22ba1ac3cf

RemcosRAT

c0a656a2f73c254ed2f1e73630083849890b7c1e36161e89fe29d2fd014f9fff

RemcosRAT

f9441d3651d67748ec1a2fd325ea1aa9d914208c7fae0853e5b769e52e66ccb8

RemcosRAT

+ 6'021 additional samples on MalwareBazaar

Result

Malware family:

remcos

Score:

10/10

Tags:

family:remcos rat rezer0

Link:

https://tria.ge/reports/201109-c93mfkqjas/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

ServiceHost packer

rezer0

Remcos

Malware Config

C2 Extraction:

91.193.75.178:8769

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_RemcosRAT Create hunting rule
Author:	abuse.ch

Rule name:	win_remcos_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator