MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d3146b1c0e38f200abfdd2439db31b3cc5271d320495015d68ea2fab35e6ed14. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemcosRAT

Vendor detections: 5

Intelligence 5 IOCs YARA 2 File information Comments

SHA256 hash:	d3146b1c0e38f200abfdd2439db31b3cc5271d320495015d68ea2fab35e6ed14
SHA3-384 hash:	9c3f3ce57b8a682ed5789f3d9aeaf60695dec8eee2bf571408e57585983852280791ac50d5302b5a62e49bb00b7b5f6a
SHA1 hash:	a84de1e45ba676302061947b6b225ca7874dab08
MD5 hash:	42938883cc03a62def0e0a3616804fa1
humanhash:	lactose-solar-ack-connecticut
File name:	DHL_414568539649 receipt document,pdf.exe
Download:	download sample
Signature	RemcosRAT Create hunting rule
File size:	393'216 bytes
First seen:	2020-06-10 07:24:44 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	6144:JJxkG1gF/hK1TpF0GyviWrU9/AG7HodYfHvU/X4sYGXW:63hKVpF0ZvNUQYfHvU/oGXW
Threatray	18 similar samples on MalwareBazaar
TLSH	8784D5C0E2483CFDE81A17724D36AD252153BD7D96B5512FA40FB42A9AF728334B2C5B
Reporter	abuse_ch
Tags:	DHL exe RAT RemcosRAT

abuse_ch

Malspam distributing RemcosRAT:

HELO: cloudhost-67388.au-south-1.nxcli.net
Sending IP: 103.224.90.42
From: DHL Support <support@dhl.com>
Subject: Re: DHL Shipment Notification
Attachment: DHL_414568539649 receipt document,pdf.iso (contains "DHL_414568539649 receipt document,pdf.exe")

RemcosRAT C2:
nagod.ddns.net:8811 (216.38.7.231)

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Gathering data

Threat name:

ByteCode-MSIL.Trojan.Kryptik

Status:

Malicious

First seen:

2020-06-10 07:26:08 UTC

AV detection:

28 of 31 (90.32%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=2mkgwhaohdzabk752jbz3my3htcsohjsaskqcxli5ix2wnpg5uka._file

Verdict:

malicious

RemcosRAT

23fe3d759096d3abab9d28e0135754ea969c0e7cd9d32d1ed6191debb838e77a

RemcosRAT

3f58539eb2353fb30a4d0d2e3e1f8db5c51a21df564c138953fbe1e2bb396284

RemcosRAT

4c26d9cbfa013795a0f2449f5a8c5bf3c880d4292d6ee2218f7a0520aff6b1ac

RemcosRAT

5d45333978e4e002d9a5c293f6ea8e19a93154fc5e3a7401c793ebeda53588ee

RemcosRAT

7c07f9bede2e4dd632d824e779849898ed943b7eb52a2abb2c3d6b6b2491b653

RemcosRAT

92f6d1e82205b64904076dbcb9909bc3ff06cd4c58c87518470eefdd8b4df084

RemcosRAT

9506b360562938955b9bc493596b790defaa81777c2652395a2438c553b5f5a8

RemcosRAT

e4c807505f6c4a6c8369f3e78dc51a7bb5e6969803fc2ee9f992fe623b8a1dd6

RemcosRAT

f8fb35d8b6401fa65a471788e4f8168390c49a25ddbabe0ce475bed8dd8840ff

RemcosRAT

+ 8 additional samples on MalwareBazaar

Result

Malware family:

remcos

Score:

10/10

Tags:

family:remcos rat

Link:

https://tria.ge/reports/201109-5mrxswt226/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Uses the VBS compiler for execution

Remcos

Malware Config

C2 Extraction:

nagod.ddns.net:8811

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_RemcosRAT Create hunting rule
Author:	abuse.ch

Rule name:	win_remcos_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator