MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f6b725654c8d666688aaa90def223e8592a17110aead0e275c35c64e18c10985. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 4


Intelligence 4 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f6b725654c8d666688aaa90def223e8592a17110aead0e275c35c64e18c10985
SHA3-384 hash: f7b5585c27ecdac7fb5e900e6738c08adbac78b148837c06a27d20a75734cc97151a837d3b0bc23630a450d9f07e1727
SHA1 hash: 17bc6c9a95bd3a41826b1cee45e77c5567dc85da
MD5 hash: 0be1a5ba522f2a8eb9d6bfe86721f97e
humanhash: saturn-virginia-leopard-purple
File name:Payment.exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'188'352 bytes
First seen:2020-05-20 17:46:06 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash bdaba7e33391c6a591b557693e8203c7 (3 x RemcosRAT, 1 x AveMariaRAT)
ssdeep 24576:d01xAsrWCaJ67REfnnaTOs4tYj+RtU8Fe/wA3:2cDCdLTOsIouU8FS
Threatray 807 similar samples on MalwareBazaar
TLSH C9458F21F5E28437D273593B9E0B9634A826BF411E3759993ADC3C4CDB7B3423639292
Reporter abuse_ch
Tags:exe RAT RemcosRAT


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: node.com
Sending IP: 173.82.202.166
From: Anderson<anderson@tammynpeterson.us>
Subject: Payment
Attachment: Payment.gz (contains "Payment.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
93
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.BorlandDelphi-15
Create hunting rule

SecuriteInfo.com.Gen.NN.ZelphiCO.34110.iLW@aS5Yzqfi.26874.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Delf
Create hunting rule
Status:
Malicious
First seen:
2020-05-20 18:10:00 UTC
File Type:
PE (Exe)
Extracted files:
23
AV detection:
26 of 31 (83.87%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=623skzkmrvtgncfkveg66ir6qwjkc4iqv2wq4j24gxde4ggbbgcq._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
029c973cf95aad6fd32af2475d767633002e6139a7d04bc6d23574dcd7e49eda
RemcosRAT
09394473fc2c076486970d70011c480439b9e799be2966197e1d35bb9ee7b506
RemcosRAT
3484fffe14e6d045c8a5c568187f686d4479693dadb3fc4631b7d307000b5148
RemcosRAT
36a40ec4deea590187112deb4f39489b2a01de2680f85504b8d59d19cee145c5
RemcosRAT
654dcb8cbaca77d6679523c36f44ea656e39a97ce7e4d6f91b089fe8d54f9787
RemcosRAT
8e81382d94e87aa1cdc85da08f858ec825bc7ca56011a2c7de2b42f7740b5f85
RemcosRAT
e24298b174f7e0ac0ff54e424e20981739f31d285969d829dfb0b7b95272b7d6
RemcosRAT
eb014a8ce4cf51f56669eccfdf4acb02794efb3897323cbe066a36194f693b85
RemcosRAT
eee72be9b19c5e0fa5fd1b5404798a7ccd5b73830249562f9465583004980a18
RemcosRAT
f332609731fb4f454cc0a03829a8dcd98b3f2b199f9ffedb7b6b0a42c1ee2180
RemcosRAT
+ 797 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-c1ev85t98a/
Behaviour
Script User-Agent
Legitimate hosting services abused for malware hosting/C2
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_RemcosRAT
Create hunting rule
Author:abuse.ch
Rule name:win_remcos_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

f1e441b52dbf05961b6c262f9f7ef1b2

RemcosRAT

Executable exe f6b725654c8d666688aaa90def223e8592a17110aead0e275c35c64e18c10985

(this sample)

  
Dropped by
MD5 f1e441b52dbf05961b6c262f9f7ef1b2
  
Delivery method
Distributed via e-mail attachment

Comments