MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fd4d0c198aa010dee3d726fe7d7a526725b51404c1684b7df9d520455e5d16ec. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 4


Intelligence 4 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fd4d0c198aa010dee3d726fe7d7a526725b51404c1684b7df9d520455e5d16ec
SHA3-384 hash: 394d67a8ca1059880171052dbeec8773cfb7bea8353cfbf90b2feae5e3cc54bb3dd01cac74d4ed0c4dd1322d1f243394
SHA1 hash: 9c399b34f7391602b3b70cb7b4b60a1af8d0b65e
MD5 hash: 575d7ca2e5fc3ff6e2d568ab8c67c5d8
humanhash: failed-thirteen-carbon-pizza
File name:Quotation Sheet and PO-including FOB, MOQ.exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:245'760 bytes
First seen:2020-05-27 13:48:43 UTC
Last seen:2020-05-28 19:35:57 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 6144:lkFHG917sIoq9VQiFYrXEZY7JrKKRrKY9BDM7:lrlQ+6XrKKRrKY9BDM
Threatray 1'088 similar samples on MalwareBazaar
TLSH 9A345B987210B6EFC867C4B699A82C64AB5034BB530BD307991351EE9A1CBD7CF544F3
Reporter James_inthe_box
Tags:exe RemcosRAT

Intelligence

File Origin
# of uploads :
4
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.33911952.1444.31421.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-27 05:31:50 UTC
File Type:
PE (.Net Exe)
Extracted files:
3
AV detection:
23 of 31 (74.19%)
Threat level:
  2/5
Verdict:
malicious
Label(s):
hawkeyekeylogger
Create hunting rule
emotet
Create hunting rule
remcos
Create hunting rule
gozi
Create hunting rule
Similar samples:
345eea8453a5fd5cd1a5aa11865ef59c187a30b61bf221c2d6276f0f8f4c907c
RemcosRAT
4862395a8b8b73119c051b767f84b352f96cadbe062e25de2bb9a1ce1a7cadbb
RemcosRAT
4ea3eef0add7aca2f63815588a3a3131c876a50e189e6764f991e15bfc5167fd
RemcosRAT
5ce2d2774ba40e6dc9997abefd9d8d50321eb37b26e3b6963add26877f036a3e
RemcosRAT
61555d07d935ff4096f2d513bcc75ea5da6abbd5edc7c9da6d93343b4a59ecb0
RemcosRAT
add7909ba8ec7d84e958787f2eb5f2b03acdba3d5652bef49555fdc129161d99
RemcosRAT
afa35fe4f4123c181f93d54914069a0e4f4ce56aa30f8051b2eec2ea66a0881a
RemcosRAT
ce9b74488d4bd5cc49f44ec2bb67aa7718500a4feb49731b3d77ad1d459dd600
RemcosRAT
eb32ecc1e5e824d6b3d8c56cb979c4b025f3c7f906a75f42c8eb2fb899418d18
RemcosRAT
f0eeee0b7a5902ffc700cb87a26c9575016911d603a783335e80472ed40ba09e
RemcosRAT
+ 1'078 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos coreentity rat rezer0
Link:
https://tria.ge/reports/201109-6tdcnt4ca2/
Behaviour
Creates scheduled task(s)
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
rezer0
CoreEntity .NET Packer
Remcos
Malware Config
C2 Extraction:
194.5.99.143:6666
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_RemcosRAT
Create hunting rule
Author:abuse.ch
Rule name:win_remcos_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments