MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 01de61b8b14bb1231ac14968c89b304afa74376e70ce29c7da92259a8a702b60. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 8


Intelligence 8 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 01de61b8b14bb1231ac14968c89b304afa74376e70ce29c7da92259a8a702b60
SHA3-384 hash: de7c007d13599886397c80356ce5c6b7ca95d85a77b7036c2519b9efc11b3ceb2e7dbf6a4dbd5676c6eea6732d40028e
SHA1 hash: 2b221b3e91b6ec09094e3acb43b760101a54ffdc
MD5 hash: ab8dd4310df701c40d8e3bb3a797fb79
humanhash: jupiter-stairway-may-fish
File name:ORDER07142020.exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:260'096 bytes
First seen:2020-07-15 09:55:03 UTC
Last seen:2020-07-15 10:52:21 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'650 x AgentTesla, 19'462 x Formbook, 12'203 x SnakeKeylogger)
ssdeep 6144:eIsw71phqu7h5+YPm3ggsNgH23orSuNOvoHwh8AsXqw2HQF:Rjhb5+8m3gNgH23m7d2Ho
Threatray 859 similar samples on MalwareBazaar
TLSH 5B44D014B3FC9F02E5BD8BF48675988807B6365A6561E74C0CC2F4DB267BB0496A0F27
Reporter JAMESWT_WT
Tags:RemcosRAT

Intelligence

File Origin
# of uploads :
3
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Remcos
Create hunting rule
Link:
https://www.capesandbox.com/analysis/25961/
Detection(s):
SecuriteInfo.com.Trojan.DownLoader33.59431.30601.28517.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
DNS request
Creating a file in the %AppData% subdirectories
Setting a global event handler for the keyboard
Sending a TCP request to an infection source
Detection:
remcos
Create hunting rule
Link:
https://mwdb.cert.pl/sample/01de61b8b14bb1231ac14968c89b304afa74376e70ce29c7da92259a8a702b60/
Threat name:
ByteCode-MSIL.Dropper.Dapato
Create hunting rule
Status:
Malicious
First seen:
2020-07-14 19:13:00 UTC
File Type:
PE (.Net Exe)
Extracted files:
9
AV detection:
23 of 28 (82.14%)
Threat level:
  3/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ahpgdofrjoysggwbjfumrgzqjl5hin3oodhctr62siszvctqfnqa._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
1d510653c1ea9f9a519c53d92067ab27ee434f8e5c34b980f6a236f4e02dba22
RemcosRAT
356c197426a3bdabccf7b10ece0a425571b55bbeb7e09e3121b6ff6b7c2e253a
RemcosRAT
485c1301f4bc84bc2d274f53222cf7ca5fbd8af8728d1aaa977a6574f577fb87
RemcosRAT
5106eff2035cae4bc844f175750857ecffe095b70f7872ddd212bedce7776e80
RemcosRAT
611a1ab90193672c4b95cb934a617b98314df0a24406342a0f1fedb08efd1997
RemcosRAT
83eb442b175e4fe5a2fde6e8d72618eee280398f89a81da1f9c118d2c46032d4
RemcosRAT
8c59bc29addb6c7cd78946b0f449b39ba663b0311d80c1a55b54742e7facb8af
RemcosRAT
b101b46c4af2b0bf121699278385567d8acf726dc94d85d304d86f48312065d2
RemcosRAT
e39c2e98071d4440d02e6d1aa86111536d6d01554489bd71f890455c05e424d3
RemcosRAT
eb1230ab4a5408a3d264bb51f1ff311fcf52aa97d52b801738cd5add365e77d2
RemcosRAT
+ 849 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
rat family:remcos
Link:
https://tria.ge/reports/200715-wplbxj676j/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of SetWindowsHookEx
Suspicious use of SetThreadContext
Remcos
Malware Config
C2 Extraction:
muchogroup.ddns.net:5050
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_RemcosRAT
Create hunting rule
Author:abuse.ch
Rule name:win_remcos_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RemcosRAT

Executable exe 01de61b8b14bb1231ac14968c89b304afa74376e70ce29c7da92259a8a702b60

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/413067/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/25961/

Comments